title: Why is cancan enabling with a block even though the action is index?
body: <p>This is the relevant part of my ability.rb class:</p>
  
  <pre><code>def initialize(user)
    can :manage, User do |u|·
      user == u·
    end
  end
  </code></pre>
  
  <p>According to <a href="https://github.com/ryanb/cancan/wiki/Defining-Abilities-with-Blocks" rel="nofollow">cancan documentation</a>:</p>
  
  <blockquote>
    <p>The block is only evaluated when an actual instance object is present.
    It is not evaluated when checking permissions on the class (such as in
    the index action).</p>
  </blockquote>
  
  <p>However, for the <code>UsersController</code> <code>index</code> action, even though the block isn't run, it still grants <code>:manage</code> permissions, listing the users.</p>
  
  <p>I have confirmed this by commenting out the above code, and then the user is not authorized.</p>
  
  <p>As far as I understood cancan, the block is supposed to to run (which indeed it doesn't), and if it doesn't run, then the block is considered to have returned <code>false</code>, thus not granting the permission.</p>
  
  <p>Am I getting this wrong, or is this a bug?</p>
  
  <p>I'm using cancan version 1.67.</p>