ruby on rails - Cancan: trying to restrict access to Controller with no Model of the same name -

i have foocontroller no model foo - it's gateway third-party service. in foocontroller, resource being accessed do_bar method baz. can manage else's baz, through foocontroller , want restrict management own.

in ability.rb, i've written following initialize method:

can :manage, :foo 

but want write (of course doesn't work):

can :manage, :foo   @baz.user == user end 

foocontroller:

load_resource :baz, find_by: :user_data, parent: false  def do_bar   @baz = baz.find(params[:user_data]) #necessary otherwise @baz nil   authorize! :manage, :foo    #other stuff end 

i want make @baz instance - being manipulated in foocontroller, must owned user them able manage it.

how can this?

1.define ability baz.

can :manage, baz, :user => user 

2.you can authorize manually in action.

#load_resource :baz, find_by: :user_data, parent: false  def do_bar   @baz = baz.find(params[:user_data]) #necessary otherwise @baz nil   authorize! :manage, @baz    #other stuff end