Properly setting board rules on a controller

[craigs...@gmail.com]

I have a restful controller Business with an arbitrary number of actions, most of them various versions of a show action. I would like a user role, ReadOnly, to be able to do anything with that controller, aside from anything that would modify a Business model. I do not want to have to modify Ability.rb every time a new action is added, as that's really smelly.

This is what I have now:

if user.read_only?
can :manage, Business
cannot [:update, :delete], Business
end

Is this the proper way to set these permissions?

[brite]

I think what you have is probably the best way.  Cancancan has alias for the 7 REST actions, and supports adding non-RESTful actions, but doesn't have an action alias for it. Alternatively you could manually authorize the non-RESTful actions doing something like:

authorize! :read, @business

so you can say 

can :read, Business

or setup an action alias: https://github.com/CanCanCommunity/cancancan/wiki/Action-Aliases