asdf

# config/environment.rb
config.gem "cancan"

# models/ability.rb
class Ability
  <b style="color:black;background-color:#ffff66">include CanCan</b>::Ability
  
  def initialize(user)
    user ||= User.new # guest user
    
    if user.role? :admin
      can :manage, :all
    else
      can :read, :all
      can :create, Comment
      can :update, Comment do |comment|
        comment.try(:user) == user || user.role?(:moderator)
      end
      if user.role?(:author)
        can :create, Article
        can :update, Article do |article|
          article.try(:user) == user
        end
      end
    end
  end
end

# application_controller.rb
rescue_from CanCan::AccessDenied do |exception|
  flash[:error] = "Access denied."
  redirect_to root_url
end

# articles_controller.rb
load_and_authorize_resource

# comments_controller.rb possibility
load_and_authorize_resource :nested => :article