User permissions in Rails app - ruby-on-rails

Question

My Rails app is a simple one where users can register and view jobs for a certain organization. I have set up Devise so that users must be authenticated before they can pursue certain actions like viewing jobs, posting jobs, etc. I currently have a job model and a user model. How would I go about setting permissions so that Users can create new posts and ONLY edit and delete the posts that THEY wrote?
Job.rb:
class Job < ActiveRecord::Base
# Include default devise modules. Others available are:
# :token_authenticatable, :confirmable,
# :lockable, :timeoutable and :omniauthable
devise :database_authenticatable,
:recoverable, :rememberable, :trackable, :validatable
# Setup accessible (or protected) attributes for your model
attr_accessible :contact_email, :contact_phone, :description, :district, :due_date, :expiration_date, :job_title, :posting_date, :requirements, :salary, :submission_process
end
User.rb
class User < ActiveRecord::Base
# Include default devise modules. Others available are:
# :token_authenticatable, :confirmable,
# :lockable, :timeoutable and :omniauthable
devise :database_authenticatable, :registerable,
:recoverable, :rememberable, :trackable, :validatable
# Setup accessible (or protected) attributes for your model
attr_accessible :email, :password, :password_confirmation, :remember_me
# attr_accessible :title, :body
end
Jobs_Controller.rb:
class JobsController < ApplicationController
before_filter :authenticate_user!, :except => [:show, :index]
# GET /jobs
# GET /jobs.json
def index
#jobs = Job.all
respond_to do |format|
format.html # index.html.erb
format.json { render json: #jobs }
end
end
# GET /jobs/1
# GET /jobs/1.json
def show
#job = Job.find(params[:id])
respond_to do |format|
format.html # show.html.erb
format.json { render json: #job }
end
end
# GET /jobs/new
# GET /jobs/new.json
def new
#job = Job.new
respond_to do |format|
format.html # new.html.erb
format.json { render json: #job }
end
end
# GET /jobs/1/edit
def edit
#job = Job.find(params[:id])
end
# POST /jobs
# POST /jobs.json
def create
#job = Job.new(params[:job])
respond_to do |format|
if #job.save
format.html { redirect_to #job, notice: 'Job was successfully created.' }
format.json { render json: #job, status: :created, location: #job }
else
format.html { render action: "new" }
format.json { render json: #job.errors, status: :unprocessable_entity }
end
end
end
# PUT /jobs/1
# PUT /jobs/1.json
def update
#job = Job.find(params[:id])
respond_to do |format|
if #job.update_attributes(params[:job])
format.html { redirect_to #job, notice: 'Job was successfully updated.' }
format.json { head :no_content }
else
format.html { render action: "edit" }
format.json { render json: #job.errors, status: :unprocessable_entity }
end
end
end
# DELETE /jobs/1
# DELETE /jobs/1.json
def destroy
#job = Job.find(params[:id])
#job.destroy
respond_to do |format|
format.html { redirect_to jobs_url }
format.json { head :no_content }
end
end
end

Answer 1

If you're intending to expand your system and add other roles for example admin, super admin, normal users, guests, ... etc then my advice to you is to have a look at the authentication gem of Ryan Bates which is named CanCan.
If the app is as simple as you mentioned in your answer, then you've to use the current_user method provided by the devise gem also, you've to set a relation between the job and the user. I guess it'll be a one-to-many relation (each user can have many jobs) this can be down by:
Create a new migration which adds a column to the jobs table, the column name should be user_id
Add has_many :jobs in the user model (user.rb)
Add belongs_to :user in the job model (job.rb)
In your controller the methods edit, update and destroy should be something like that
def update
#job = current_user.jobs.find(params[:id])
# the rest of the code is omitted
end
def destroy
#job = current_user.jobs.find(params[:id])
#job.destroy
# the rest of the code is omitted
end
def edit
#job = current_user.jobs.find(params[:id])
end

Answer 2

There's a gem that can help you https://github.com/ryanb/cancan
There's also a screencast demostrating how it works. http://railscasts.com/episodes/192-authorization-with-cancan
you can define with cancan what actions a determined user can execute.