Francisco Quinones

How can I do this achive this with cancan at the moment. I like to move to pundit but have to get this setup as fast as I can.

This my ability file

      class Ability
      include CanCan::Ability


      def initialize(user)
        #-----------------------------------------------------------------
        if user.role == "super_admin"
          can :manage, [ServiceCompany,User] #,:dashboard]
          cannot :manage,[ClientCompany,Company,Project,Employee,Inspection,InspectionSection,
            InspectionComponent,Section,Reply,ServiceUser,ClientUser,TaskArea,TaskSection,TaskItem,Accident,
            Incident,Training,Workorder,Turnover,:help,:project_report,:report,Complaint,Payroll]
          #-----------------------------------------------------------------
        elsif user.role == "admin"
          can :manage, [ClientCompany,Company,Employee,Inspection,InspectionSection,InspectionComponent,Section,Reply,ServiceUser,ClientUser,TaskArea,TaskSection,TaskItem,:help]
          can :manage,[Project]
          can [:read,:index,:destroy,:edit,:update,:create], [Accident,Incident,Training,Workorder,Turnover,Payroll]
          # can [:read,:index], Payroll
          can [:read,:edit,:update,:remove_photo], ServiceCompany
          can [:read,:edit,:update,:index,:destroy],Complaint
          can [:index,:trainings,:inspections_total,:workorders,:incidents,:accidents,:turnovers],:project_report
          can [:index,:trainings,:inspections],:report
          can :read, ServiceCompany
          #---------Cannot----------
          cannot :index, ServiceCompany
          #-----------------------------------------------------------------
        elsif user.role == "auditor"
          can [:read, :index], [Project,Complaint,:project_report,:report,:help]
           #---------Cannot----------
          cannot :index, ServiceCompany
          #-----------------------------------------------------------------
        elsif user.role == "cliente"
          can [:create, :read, :index], [Complaint,Reply]
          can [:show], [ClientCompany]
          cannot :index, ClientCompany
          cannot :index, InspectionSection
          can [:index,:inspections],:report
          can [:index,:read,:detail], Inspection
          can [:report_table], InspectionSection
          can [:index,:trainings,:inspections_total,:workorders,:incidents,:accidents,:turnovers],:project_report
          can [:read, :index], [Project,:help]
          #---------Cannot----------
          cannot :index, ClientCompany
          #-----------------------------------------------------------------
        elsif user.role == "gerente"
          can [:create,:read,:update,:destroy,:edit,:signature,:detail], [Accident,Incident,Training,Workorder,Turnover,Inspection,InspectionComponent,Reply,Payroll,Employee]
          can [:create,:read,:update,:destroy,:edit,:report_table],InspectionSection
          can [:index,:show],[Project,TaskArea,TaskSection,ClientCompany,:help]
          can [:index,:trainings,:inspections_total,:workorders,:incidents,:accidents,:turnovers],:project_report
          can [:index,:trainings,:inspections],:report
          can [:read,:index,:edit,:update], [TaskItem,Complaint]  
          can :read, ServiceCompany
          #---------Cannot----------
          cannot :index, ServiceCompany
          #-----------------------------------------------------------------
        else user.role == "administración"
            can [:index,:show,:read,:signature,:detail],[ClientCompany,Company,Project,Employee,Inspection,
            InspectionComponent,Section,Reply,ServiceUser,ClientUser,TaskArea,TaskSection,TaskItem,Accident,Incident,Training,
            Workorder,Turnover,:help,Payroll]
            can [:index,:show,:read,:report_table], InspectionSection
            can [:index,:trainings,:inspections],:report
            can [:index,:trainings,:inspections_total,:workorders,:incidents,:accidents,:turnovers],:project_report
            can [:create, :read, :index], Reply
            can [:edit,:update,:read, :index],Complaint
            can :read, ServiceCompany
            #---------Cannot----------
            cannot :index, ServiceCompany
        end
      end
    end

can I do the same with cancan as I got all working and setup. Thanx

Info: My models and association. I got a ServiceUser ( Manager ) model,User model, ServiceCompany model, Employee model and a Project model. A ServiceCompany can have many projects, employees and many ServiceUSer. A ServiceUser can be assign to a project and employees work at a project. Im using devise for authentication and cancan.
Models: https://gist.github.com/Frank004/c578864985b77fe284d4
Second info: My routes

    resources :service_companies, shallow: true do
    resources :service_users
    end
    resources :projects, shallow: true do
    resources :employees
    end

My problem: I got different companies and each one has his projects with different employees on each project. I can filter the project of the current user as a (client or as a manager). my problem start in the url anybody can change the ids of companies, projects or employees and view info from the other company. employee controller: https://gist.github.com/Frank004/b013218c4d4103a7ee55

Im looking for a way to only allow the information of the current project that is view and if he change the ids it wont show the other projects or parts of the projects like the employees list.

Im trying to find a way to get the project
@project and then filter the employees by the project

love it great job

Wow This just great I was looking for something like this ill be your new member on gorails. :)