ruby on rails - Cancan showing all transactions instead of only authorized -

i'm using cancan , have in usertransactionscontroller

class usertransactionscontroller < applicationcontroller  load_and_authorize_resource  def index   @company = company.find(params[:company_id]   @user_transactions = @company.user_transactions.order("date desc").all ... 

and in ability.rb have:

can [:read], usertransaction |ut|   ut.company_user.user.id == user.id end 

the line ut.company_user.user.id == user.id never seems hit. , showing user transactions, other users.

@rept, when use load_and_authorize_resource method, don't need create @user_transactions variable, that's method based on ability.rb file.

you rewriting @user_transactions load_and_authorize_resource creates line:

@user_transactions = @company.user_transactions.order("date desc").all 

if need fetch users transactions belong particular company fetching, can use accessible_by scope cancan provides as:

@user_transactions = @company.user_transactions.accessible_by(current_ability).order("date desc").all 

this should if haven't figured out now, can read more on cancan documentation on topic here: https://github.com/ryanb/cancan/wiki/fetching-records