I am using the **cancan** gem, but have run into some problems. I wrote some simple tests which failed for a user with no roles assigned to them. It can be seen that within the Ability class I try to say that a user can manage other users only if the user has the role of :admin. As noted by the comment, that block never gets called. 

In the cancan gem when you pass a block to the can? method it adds that to a rule, which is then called when you call the can? method, **unless** the the class of the object that is passed in is Class. So when I perform the test below it fails since I am passing a User and User.class == Class. 

```
it { should_not be_able_to(:create, User) }
or
it "cannot create a User" do
  expect(ability.cannot? :create, User).to be_true
end

```

With this in mind if I write a test that tests on a specific user the test passes:

```
it { should_not be_able_to(:edit, FactoryGirl.create(:user) ) }   # passes, but...

```

But that makes no sense when you are listing, or creating:

```
it { should_not be_able_to(:create, FactoryGirl.create(:user) ) }  # yuck

```

I guess you can use

```
it { should_not be_able_to(:create, User.new ) }  # but that is still full of suck

```

Reference Code:

```
class Ability
  include CanCan::Ability

  def initialize(user)
    user ||= User.new

    can :manage, User do |u|
      # this block never gets called
      user.has_role? :admin
    end
  end
end

describe "user without roles" do
  subject { ability }
  let(:ability) { Ability.new create(:user) }

  it { should_not be_able_to(:manage, User) }  # passes
  it { should_not be_able_to(:index, User) }   # all the rest fail
  it { should_not be_able_to(:new, User) }
  it { should_not be_able_to(:edit, User) }
  it { should_not be_able_to(:create, User) }
  it { should_not be_able_to(:update, User) }

end

# CANCAN CODE
# https://github.com/ryanb/cancan/blob/c88cb8f4593148f99e15627d23fbf67116dd8be2/lib/cancan/can_definition.rb#L32
def matches_conditions?(action, subject, extra_args)
  if @match_all
    call_block_with_all(action, subject, extra_args)

  ## The condition in question, this is where I should go to
  ## subject -> User
  ## User.class -> Class
  elsif @block && !subject_class?(subject)
    @block.call(subject, *extra_args)
  elsif @conditions.kind_of?(Hash) && subject.kind_of?(Hash)
    nested_subject_matches_conditions?(subject)
  elsif @conditions.kind_of?(Hash) && !subject_class?(subject)
    matches_conditions_hash?(subject)
  else
    @base_behavior
  end
end

# User class returns true
def subject_class?(subject)
  (subject.kind_of?(Hash) ? subject.values.first : subject).class == Class
end

```

Since cancan is pretty popular I putting money on the fact that I am doing something wrong. Any help would be greatly appreciated.