title: Rails 3, Cancan: defining ability on custom controller action acting on collection, not member
body: <p>I have a RESTful controller for the model <code>UserResource</code>. I added a custom action called <code>remote_update</code> and I want to limit that action only if the user's id matches:</p>
  
  <pre><code>if user.has_role? :admin
    can :manage, :all
  
  elsif user.has_role? :regular
    can [:remote_update], UserResource, :user_id =&gt; user.id
  
  end
  </code></pre>
  
  <p>I am using <code>load_and_authorize_resource</code> in the controller.</p>
  
  <p>The problem is that users are still able to use that action even if their user id does not match. (To test, I am using Firebug and changing the hidden value of the id).</p>
  
  <p>My route is as follows:</p>
  
  <pre><code>resources :user_resources do
  
  collection do
    post 'remote_update'
  end
  </code></pre>
  
  <p>end</p>
  
  <p>According to <a href="https://github.com/ryanb/cancan/wiki/Authorizing-controller-actions" rel="nofollow">https://github.com/ryanb/cancan/wiki/Authorizing-controller-actions</a>, when we have custom actions, Cancan tries to load the resource using the id, from the link:</p>
  
  <pre><code>def discontinue
   # Automatically does the following:
   # @product = Product.find(params[:id])
   # authorize! :discontinue, @product
  end
  </code></pre>
  
  <p>I don't have an id defined because it is a POST, not a GET or PUT. 
  THoughts on how to construct the ability? Thank you.</p>