title: Use CanCan to define permissions additively
body: <p>My application has 2 roles: Editor, and Admin. I want Editors to have some permissions, and Admins to have all editor permissions plus some other permissions.</p>
  
  <p>Here is an excerpt from my <code>ability.rb</code></p>
  
  <pre><code>class Ability
    include CanCan::Ability
  
    def initialize(user)
      if user.is_admin?
        can :edit, Post
      end
  
      if user.is_editor?
        can :edit, Post, :created_by_id =&gt; user.id
        can :read, Post
      end
    end
  end
  </code></pre>
  
  <p>Since <em>all admins are also editors</em>, I hoped this would define these permissions:</p>
  
  <ul>
  <li>Admins can read and edit all posts</li>
  <li>Editors can read all posts, but only modify those which they created</li>
  </ul>
  
  <p>However, CanCan doesn't seem to define permissions additively – i.e., when CanCan sees that a user is an Editor (even if the user is <strong>also</strong> an admin), it applies the more restrictive permission (i.e., <code>can :edit, Post, :created_by_id =&gt; user.id</code> instead of <code>can :edit, Post</code>).</p>
  
  <p>Is there any way around this? The obvious solution requires repeating code:</p>
  
  <pre><code>class Ability
    include CanCan::Ability
  
    def initialize(user)
      if user.is_admin?
        can :edit, Post
        can :read, Post # NOT DRY!!!
      elsif user.is_editor?
        can :edit, Post, :created_by_id =&gt; user.id
        can :read, Post
      end
    end
  end
  </code></pre>