CANCANCAN Permission to own data - ruby-on-rails

Question

A question please!
I don't know how to only give permission to user to update only his own data:
ability.rb
elsif user.has_role? :user
can :update, User, id: user.id
else
user_controller.rb
def update
a = Ability.new(current_user)
user = User.find params[:id]
if a.can? :update, User, id: user.id
...
This returns true on any ID.
Aditional data with pry:
[3] pry(main)> a = Ability.new(u)
Role Load (0.7ms) SELECT `roles`.* FROM `roles` INNER JOIN `users_roles` ON `roles`.`id` = `users_roles`.`role_id` WHERE `users_roles`.`user_id` = 3 AND (((roles.name = 'admin') AND (roles.resource_type IS NULL) AND (roles.resource_id IS NULL)))
Role Load (0.4ms) SELECT `roles`.* FROM `roles` INNER JOIN `users_roles` ON `roles`.`id` = `users_roles`.`role_id` WHERE `users_roles`.`user_id` = 3 AND (((roles.name = 'user') AND (roles.resource_type IS NULL) AND (roles.resource_id IS NULL)))
=> #<Ability:0x007f908ba931e8
#rules=
[#<CanCan::Rule:0x007f908be9b2b8
#actions=[:update],
#base_behavior=true,
#block=nil,
#conditions={:id=>3},
#match_all=false,
#subjects=
[User(id: integer, email: string, encrypted_password: string, reset_password_token: string, reset_password_sent_at: datetime, remember_created_at: datetime, sign_in_count: integer, current_sign_in_at: datetime, last_sign_in_at: datetime, current_sign_in_ip: string, last_sign_in_ip: string, created_at: datetime, updated_at: datetime, auth_token: string, name: string, surnames: string)]>],
#rules_index=
{User(id: integer, email: string, encrypted_password: string, reset_password_token: string, reset_password_sent_at: datetime, remember_created_at: datetime, sign_in_count: integer, current_sign_in_at: datetime, last_sign_in_at: datetime, current_sign_in_ip: string, last_sign_in_ip: string, created_at: datetime, updated_at: datetime, auth_token: string, name: string, surnames: string)=>
[0]}>
[4] pry(main)> a.can? :update, User, id: 3
=> true
[5] pry(main)> a.can? :update, User, id: 2
=> true
What i'm doing wrong?
Thanks!

Answer 1

#app/models/ability.rb
class Ability
include CanCan::Ability
def initialize(user)
user ||= User.new # guest user (not logged in)
if user.has_role? :user
can :update, User, id: user.id
else
can :read, :all
end
end
end
#app/controllers/users_controller.rb
class UsersController < ApplicationController
def update
#user = User.find params[:id]
authorize! :update, #user
...
end
end
From the docs:
CanCanCan expects a current_user method to exist in the controller.
You don't need to explicitly invoke Ability, it's done via authorize! or can?