Q: How to restrict the users from edit and delete actions, based on the roles they have assigned I am working on a rails project where I have User and Roles models, which I have linked with the UserRole model, using has_many through association. Now my problem is to display the users action according to their roles. Actions consists of show, edit and delete. Player, admin and super admin should be able to view and edit their own profiles. Admin should be able to edit, assign and delete himself and player, but he should not be able to edit or destroy super admin. Super admin should be able to do everything on everyone.
This is my index page where every users gets displayed with their info, which I wrote for only assigning roles
<% if signed_in_user.role?'admin' || signed_in_user.role?'super admin'  %>
  <%= link_to t('.assign_role', default: t("helpers.links.assign")),
     new_user_role_path(user_id: user.id),
     method: :get,
     class: 'btn btn-default btn-xs' %>
<%end%>

this is my schema 
create_table "roles", force: :cascade do |t|
  t.string "name"
  t.boolean "active"
  t.integer "counter"
  t.datetime "created_at", null: false
  t.datetime "updated_at", null: false
end

create_table "user_roles", force: :cascade do |t|
  t.integer "role_id"
  t.integer "user_id"
  t.datetime "created_at", null: false
  t.datetime "updated_at", null: false
  t.index ["role_id"], name: "index_user_roles_on_role_id"
  t.index ["user_id"], name: "index_user_roles_on_user_id"
end

create_table "users", force: :cascade do |t|
  t.string "first_name"
  t.string "last_name"
  t.string "email"
  t.string "photo"
  t.datetime "created_at", null: false
  t.datetime "updated_at", null: false
  t.string "encrypted_password", default: "", null: false
  t.string "reset_password_token"
  t.datetime "reset_password_sent_at"
  t.datetime "remember_created_at"
  t.index ["reset_password_token"], name: "index_users_on_reset_password_token", unique: true
end

