只允許使用CanCanCan創建受限用戶

Question

我希望管理員用戶無法創建具有超級管理員角色的用戶，但仍能夠創建其他管理員和常規用戶。我該如何做到這一點？這裏是我的Ability.rb：

class Ability 
    include CanCan::Ability 

    def initialize(user) 
    if user.super_admin? 
     can :manage, :all 
    elsif user.admin? 
     can :manage, [Article, Comment] 
     can [:destroy, :update], User, :role_id => 2 # If Admin 
     can [:destroy, :update], User, :role_id => 3 # If User 
     can :read, User 
     can :create, User 
    elsif user.user_regular? 
     #cannot :read, ActiveAdmin::Page, :name => "Dashboard" 
     #can :manage, :all 

    end 
    end 
end 

Answer 1

使用cannot在admin塊像cannot :creat, User, :role_id => 1 # let 1 is super admin role id。你可以得到更多關於聯合能力的信息at here