CanCan Authorization: Restrict resources by request format JSON

restrict_by_request_type.rb

# Lock down controller actions with CanCan based on request format.

class Ability
  include CanCan::Ability

  def initialize(user, format=nil)
    user ||= User.new
    can :index, Model if format == "application/json"
  end
end


class SomeController < ApplicationController
  authorize_resource

  def index
    respond_to do |format|
      format.html do
        @something = Model.find_something
      end
      format.json do
        render json: Model.find_something.to_json
      end
    end
  end

protected

  def current_ability
    @_current_ability ||= Ability.new(current_user, request.format)
  end
end