Authorize Admin for certain actions

access_denied.js.erb

$('.flash_messages').html('<%= j flash_tag("Access Denied!", "alert") %>')

application_controller.rb

class ApplicationController < ActionController::Base
  # Prevent CSRF attacks by raising an exception.
  # For APIs, you may want to use :null_session instead.
  protect_from_forgery with: :exception

  protected

    def deny_access!
      if request.xhr?
        render 'common/access_denied'
      else
        redirect_to root_path, alert: "Access Denied!"
      end
    end

    def authorize_admin!
      deny_access! unless current_user.admin?
    end
end

application_helper.rb

module ApplicationHelper
  def flash_tag(msg, msg_type)
    return unless msg.present?
    if msg_type == "notice"
      msg_type = "info"
    elsif msg_type == "alert"
      msg_type = "danger"
    end

    content_tag(:div, class: "alert alert-#{msg_type} alert-dismissible", role: "alert") do
      button_tag(class: "close", "data-dismiss" => "alert") do 
        content_tag(:span, raw("×"), "aria-hidden" => true) +
          content_tag(:span, "Close", class: "sr-only")
      end + msg
    end
  end
end

items_controller.rb

class ItemssController < ApplicationController
  # This is provided by `devise` gem
  before_action :authenticate_user!
  # We define this in `ApplicationController`
  before_action :authorize_admin!, except: [:index, :show]
  
  def index
    ...
  end
  
  def show
    ...
  end
  
  def new
    ...
  end
  
  def create
    ...
  end
end