cancancan abilities

ability.rb

# app/models/ability.rb
module Ability
  class << self
    def ability_for user, options = {}
      abilities = AnonymousAbility.new

      return abilities unless user

      abilities.merge MemberAbility.new user, options

      if user.has_role? 'administrator'
        abilities.merge AdministratorAbility.new
      end

      abilities
    end
  end
end

application_controller.rb

# app/controllers/application_controller.rb or any controller
class ApplicationController < ActionController::Base
  def current_ability
    @current_ability ||= Ability.ability_for current_customer
  end
end
  

member_ability.rb

# app/abilities/member_ability.rb
class MemberAbility
  include CanCan::Ability

  attr_accessor :current_user

  def initialize current_user, options = {}
    can :update, User do |user|
      user.email == current_user.email
    end

    can :update, Profile do |profile|
      profile.owners.include? current_user
    end
  end
end