Implement role authorization

app/controllers/admin/registrations_controller.rb

@@ -1,8 +1,10 @@
 module Admin
   class RegistrationsController < ApplicationController
-    before_filter :verify_organizer
+    load_and_authorize_resource :conference, find_by: :short_title
+    load_and_authorize_resource through: :conference
 
     def index
+      authorize! :show, Registration.new(conference_id: @conference.id)
       session[:return_to] ||= request.referer
       @pdf_filename = "#{@conference.title}.pdf"
       @registrations = @conference.registrations.includes(:user)
@@ -12,7 +14,6 @@ module Admin
     end
 
     def change_field
-      @registration = Registration.find(params[:id])
       field = params[:view_field]
       if @registration.send(field.to_sym)
         @registration.update_attribute(:"#{field}", 0)
@@ -26,12 +27,10 @@ module Admin
     end
 
     def edit
-      @registration = @conference.registrations.where('id = ?', params[:id]).first
       @user = User.where('id = ?', @registration.user_id).first
     end
 
     def update
-      @registration = @conference.registrations.where('id = ?', params[:id]).first
       @user = User.where('id = ?', @registration.user_id).first
       begin
         @user.update_attributes!(params[:registration][:user_attributes])
@@ -55,6 +54,7 @@ module Admin
     def new
       @user = User.new
       @registration = @user.registrations.new
+      @registration.conference_id = @conference.id
       @supporter_registration = @conference.supporter_registrations.new
     end
 
@@ -97,7 +97,7 @@ module Admin
     end
 
     def destroy
-      if has_role?(current_user, 'Admin')
+      if can? :destroy, @registration
         registration = @conference.registrations.where(id: params[:id]).first
         user = User.where('id = ?', registration.user_id).first