ruby - How do I modify devise so that Pins are read only on Rails 4.2.4 -

i junior developer building first web application customer using rails 4.2.4, devise authentication , pins scaffolding listing of customers products sale.

everything working, users can signup , login , create, read, update , destroy pins.

problem is, don't want users able create, update or destroy pins on index.html.erb page. (only view such customer sales products)

if @ image attached. when click on ladies products btn on home page takes index.html.erb pins listed.

nb: still want users able signup , log in through devise, update address details shipping , not change pins content. pins crud content should created customer.

how should approach this.

how should approach this

you're looking @ authorization...

• authentication process of verifying (login).
• authorization process of verifying have access (permission).

--

devise authentication (user logged in), authorization different matter.

ryan bates (railscasts) made very video & tutorial - made gem called cancancan bulwark of rails authorization; pundit another.

what you're asking how give permission users of type perform actions. answer use either cancancan or pundit evaluate whether user have credentials crud pin:

#gemfile  gem "cancancan"  #app/models/ability.rb class ability   include cancan::ability    def initialize(user) #-> looks "current_user" devise     user ||= user.new # guest user (not logged in)     if user.customer?       can :manage, pin     else       cannot :manage, pin     end   end end  #app/controllers/pins_controller.rb class pinscontroller < applicationcontroller    load_and_authorize_resource end 

the above allow users set customer manage pin. since you've been scant model / controller code, above specific can it.