six gem usage

ability_rules.rb

class AbilityRules
  class AccessDenied < Exception
  end

  def self.allowed(user, subject)
    rules = []

    railse [user, subject].inspect # <--- this exception was rescued by six rescue block (of course it need only in development for debug :)
    
    return rules unless user

    rules << :manage if subject == User and user.perm_users_manage?
    rules << :show if subject == Version and user.perm_versions_show?
    # ...

    rules
  end
end

application_controller.rb

class ApplicationController < ActionController::Base
  protect_from_forgery
  before_filter :create_ability
  helper_method :can?
  helper_method :should!

  rescue_from AbilityRules::AccessDenied do |exception|
    redirect_to root_url, :alert => 'Access denied.'
  end

  protected
  def create_ability
    @ability = Six.new
    @ability.add(:ability, AbilityRules)
  end

  def can?(action, subject)
    @ability.allowed?(current_user, action, subject)
  end
  
  def should!(action, subject)
    raise AbilityRules::AccessDenied unless can?(action, subject)
  end
end

application_helper.rb

module ApplicationHelper
  def render_menu
    content_tag(:div, :class => 'menu') do
      out = []
      out << link_to_unless_current('users', users_path) if can? :manage, User
      out << link_to_unless_current('versions', versions_index_path) if can? :show, Version
      # ...
      out.join(" ").html_safe
    end
  end
end

users_controllers.rb

class UsersController < ApplicationController
  before_filter :authenticate_user!
  before_filter :check_ability, :except => [:profile, :update_profile]

  # ...

  private
  def check_ability
    should!(:manage, User)
  end
end