title: Applying cancan to custom actions
body: <p>I'm working on a polling app and use Devise and Cancan for authentication and authorization. I have a User model generated by Devise and a Poll model. A poll belongs to a user. My problem is that I have a custom action in my Polls controller and I can't get Cancan to work with that custom action. This is what I tried to do in my code:</p>
  
  <p>config/routes.rb:</p>
  
  <pre><code>match 'users/:user_id/polls' =&gt; 'polls#show_user'
  </code></pre>
  
  <p>Ability.rb:</p>
  
  <pre><code>def initialize(user)
    user ||= User.new
  
    if user.is? :admin
      can :manage, :all
    else # default
      can :read, :all
      can :manage, Poll, :user_id =&gt; user.id
      can :show_user, Poll, :user_id =&gt; user.id
    end # if else admin
  end
  </code></pre>
  
  <p>polls_controller.rb:</p>
  
  <pre><code>class PollsController &lt; ApplicationController
    before_filter :authenticate_user!
    load_and_authorize_resource :except =&gt; :show_user
  
    def show_user
      authorize! :show_user, user
      @polls = Poll.find_all_by_user_id(params[:user_id])
      render "index"
    end
    &lt;...&gt;
  end
  </code></pre>
  
  <p>The idea is that a user's polls can be viewed only when the owner of the poll is signed in. However, with this code, when a poll's owner is signed in, that user gets kicked out of that page with a message that says authorization failed. If I remove the line <code>authorize! :show_user, user</code>, then a user who's signed in can view all other user's polls (the authorization doesn't work at all).</p>
  
  <p>Can anyone see what I might be missing? Thanks in advance!</p>