ability.rb

def initialize(user)
  user ||= User.new # Guest user  
  if user.role? :admin  
    can [:index, :show, :new, :edit, :create, :update, :destroy], [User, CommonContents, Logo]
  else
    can [:show, :edit, :update], User
    cannot [:index, :show, :new, :edit, :create, :update, :destroy], [CommonContents, Logo]
  end
end

application_controller.rb

private
def random_password(length = 10)
  alphanumerics = [('0'..'9'),('A'..'Z'),('a'..'z')].map {|range| range.to_a}.flatten
  (0...length).map { alphanumerics[Kernel.rand(alphanumerics.size)] }.join
end

spec_helper.rb

def current_user(stubs = {})
  @current_user ||= mock_model(User, stubs)
end

def user_session(stubs = {}, user_stubs = {})
  @current_user_session ||= mock_model(UserSession, {:user => current_user(user_stubs)}.merge(stubs))
end

def login(session_stubs = {}, user_stubs = {})
  UserSession.stub!(:find).and_return(user_session(session_stubs, user_stubs))
end

def logout
  @user_session = nil
end

def login_as_admin
  login({}, {:role => 'admin'})
  @current_user.stub(:role?).with(:admin).and_return(true)
end

users_controller.rb

def create
  # New users can only be created by admins
  authorize! :create, User
  # When the user is first defined by admin, the password is not set
  # Create a random one to satisfy validation requirements, which the user changes when they first visit
  params[:user][:password] = random_password() 
  params[:user][:password_confirmation] = params[:user][:password]

  @user = User.new(params[:user])
  
  if @user.save
    redirect_to(@user, :notice => 'User was successfully created.')        
  else
    @roles = User.const_get("ADMIN_CAN_CREATE")
    render :action => "new"
  end
end