Yes, you can add fine grain control by adding a before_filter to the appropriate refinerycms controllers. In that before_filter you could use CanCan, but refinerycms already has a roles table that you can easily leverage for this.
Here's one way to control access to the blog, for example.
Using the console or other interface of your choice, add a new Role with title="member".
Add another with title="premium_user"
Then (if your authentication model is called User), in the console
>member1 = User.find(1)
>member1.roles << Role.where(:title=>"member").first
>member1.save
Similarly, you would add the "premium_user" role to the right users.
Create MyApp/lib/restrict_blog_to_member_role.rb
module RestrictBlogToMemberRole
def restrict_blog_to_member_role
return true unless !(current_user.try(:has_role? "member")
flash[:notice]="Please become a member with us before accessing the blog."
redirect_to home_path #or some other destination path that exists
return false
end
end
In MyApp/config/application.rb, set up the before_filter so it will reload on each call in development mode, in case you change it with the server running....
module MyApp
class Application < Rails::Application
....
config.before_initialize do
require 'restrict_blog_to_member_role'
end
config.to_prepare do
BlogController.send :include, RestrictBlogToMemberRole
BlogController.send :before_filter, :restrict_blog_to_member_role
end
....
end
end
You can do the same with other refinery controllers like PagesController, Admin::BaseController, Admin::RefinerySettingsController, Admin::Blog::PostsController, etc., and add methods dealing with other roles like "premium_user", depending on what authorization rules you want to implement.
Alternatively, you can override the refinery controllers directly in your app/controllers folder using
rake refinery:override controller=blog_controller #for example.
Then you can incorporate calls to something like CanCan, or add the before filters above directly. If you override, it is a little harder to upgrade refinerycms when it changes, because you have the extra step of re-overriding and re-merging your code with the latest version of the controller, when it changes.
Re: "admin" user, refinerycms is already going to leverage a role with title="Superuser" and require that at least 1 User has that role. It comes pre-configured with some authorization logic for what Superuser can do that those without that role cannot.
