users_controller.rb

class Admin::UsersController < Admin::ApplicationController
  def index
    @users = policy_scope(User)
  end

  def new
    @user = User.new
    authorize @user
  end

  def create
    @user = User.new(user_params)
    authorize @user

    if @user.save
      redirect_to [:admin, :users]
    else
      render :new
    end
  end

  def edit
    @user = User.find(params[:id])
    authorize @user
  end

  def update
    @user = User.find(params[:id])
    authorize @user

    if @user.update_attributes(user_params)
      redirect_to [:admin, :users]
    else
      render :edit
    end
  end

  def destroy
    @user = User.find(params[:id])
    authorize @user
    @user.destroy
    redirect_to [:admin, :users]
  end

  private

  def user_params
    params.require(:user).permit(*policy(@user || User.new).permitted_attributes)
  end
end