I put together a basic recipe for a Rails 3 site to get Devise and CanCan working to enable authentication and authorization on a minimal site. I also threw in a small tweak to get it to work “out of the box” on Heroku – which basically means a change to use SQLite3 only in development and to use Postgres in production instead.

There are two sets of steps you have to run to get this basic functionality working:

  1. Run a series of rake tasks to configure Devise and CanCan, to create a User model that is configured with Devise, and to create an Authorization model for CanCan to work with.
  2. Patch various Rails config files for basic Devise configuration, and to modify the User and Authorization migrations as required.

Here’s what you get after you apply the patches (note that you have to know where to apply the patches … I’ll add in a script later to do that for you.

  1. Devise configured like it says to do it on the Github site, along with Devise views generated.
  2. A model called Authorization that manages the foreign key association between Roles and Users.
  3. A name attribute in the User model which is the authentication key.

Caveat emptor: this isn’t configured for the most top-notch security. Use at your own risk. It’s only meant to help you get the book-keeping code out of the way so you can start building your site with sign-up/in and roles built in – you still have to add the actual abilities into models/ability.rb.

The code is on Github – https://github.com/siruguri/baseline_rails_3_install