cancancan ability returns false but is still accessible?

Question

I have a standard cancancan setup. The Article model has an attribute approved. Then standard setup:

# articles controller

load_and_authorize_resource only: [:index, :show] 

def show 
end

# ability.rb

    # Solution 1
    # can :show, Article, { approved: true }


    # Solution 2
    can [:show], [Article] do |article|
      article.approved? 
    end

When I try either of the solutions, the results return as expected in the console or debugger (i.e. ability.can?(:show, @article) returns true if the article has been approved, and false otherwise).

The strange thing is, the show view is still accessible in the browser, when the false returned above clearly states that it shouldn't be accessible.

I can't work out why?

Answer 1

After much help debugging in another forum, we never figured out why the above didn't work. But the desired behaviour was implemented by not using load_and_authorize_resource, and instead placing this in the controller action:

authorize! :show, @article

I'd be very curious to understand why this approach works, but the initial approach doesn't.