devise_for: How should we do so that only admin can create normal users?

Question

In the devise_for module we have right now, we have at least two roles: admin and user. My goal is that at any given time, there is one admin, and only admin can create/delete other users. I've followed this post so that I have to login and have permissions to create a new user, since by default the sign_up page needs no permission. However, right now there is no difference between an admin and a user, meaning that both roles can create others, which is not my desired functionality. What should I do so that only an admin can create other users, i.e., when accessing /users/sign_up under the role of a user, it will pop out an error like "not enough permission?"

Let me give you what I have right now:

app/policies/user_policy.rb:

class UserPolicy
  attr_reader :current_user, :model

  def initialize(current_user, model)
    @current_user = current_user
    @user = model
  end

  def index?
    @current_user.admin?
  end

  def new?
    @current_user.admin?
  end

  def show?
    @current_user.admin? or @current_user == @user
  end

  def create?
    @current_user.admin?
  end

  def update?
    @current_user.admin?
  end

  def destroy?
    return false if @current_user == @user
    @current_user.admin?
  end
end

app/controllers/registrations_controller.rb

class RegistrationsController < Devise::RegistrationsController
  prepend_before_action :require_no_authentication, only: [:cancel]
  prepend_before_action :authenticate_scope!, only: [:new, :create, :edit, :update, :destroy]

  def new
    super
  end
end 

config/routes.rb:

...
  devise_for :users, :controllers => {:registrations => "registrations"}
  resources :users
...

P.S. I try to see what I can do for the original code devise/registrations_controller.rb [link], but didn't see anything obviously enough for me to change...

Answer 1

Something like this might help:

class RegistrationsController < Devise::RegistrationsController
  prepend_before_action :require_no_authentication, only: [:cancel]
  prepend_before_action :authenticate_scope!, only: [:new, :create, :edit, :update, :destroy]
  before_action :authorize_user!, only: [:new, :create]

  def new
    super
  end

private

  def authorize_user!
    if !current_user || !current_user.admin?
      redirect_to '/', notice: "Your permissions do not allow access to this page"
    end
  end

  # Override from Devise::RegistrationsController to not sign in after sign up
  def sign_up(resource_name, resource)
    # Nothing to do
  end
end

Now that the code is out of the way, it's time for some explanations. The first bit of code adds a before_action handler, which specifies to call the authorize_user! method, but only when the action being executed is either new or create. While the derived controller doesn't define a create method, it's available from the base controller. (Side note: the new method doesn't add anything here, and can be deleted at any time).

The authorize_user! method is declared private, so that it can't be accidentally called from outside the controller - this is specifically to prevent security vulnerabilities.

Within the method, the user is checked to make sure first that someone is logged in, and then that the logged in user has Admin privileges. If the authorization fails, the user will be redirected to the home page (to the '/' route) with a notification message to tell them that they're not worthy.

A sign_up method is called from within the Devise RegistrationsController#create method, and the default implementation is to immediately call sign_in. As it's preferable to keep the admin user logged in, the method is overridden in the application's RegistrationsController to omit the unwanted sign_in step.

In a situation in which the admins create user accounts, it's useful to omit the link to the signup page when the current user is not an admin. Something like this snippet normally works for me:

<% if current_user && current_user.admin? %><%= link_to "Sign Up", devise_signup_link %><% end %>

To use this snippet, you'll need to update the link_to tag to use your application's semantics (link text, route, HTML attributes, etc).

Once you have these items in place, your signup page will be inaccessible to non-admin types, and attempts to access it will result in a suitable error message.