title: CanCan check_authorization not throwing AccessDenied Exception for Non RESTful Controller
body: <p><strong>Motivation</strong></p>
  
  <p>I'm trying to use CanCan in an application where one of the controllers isn't associated with a resource - non RESTful controller. I want actions for that controller to be authorized conditionally dependant on other resources and session parameters.</p>
  
  <p><strong>Background</strong></p>
  
  <p><a href="https://github.com/CanCanCommunity/cancancan/wiki/Non-RESTful-Controllers" rel="nofollow noreferrer">The CanCanCan documentation for Non RESTful controllers</a> states that </p>
  
  <blockquote>
    <p>you should not use the load_and_authorize_resource method since there
    is no resource to load. Instead you can call authorize! in each action
    separately.</p>
  </blockquote>
  
  <p>Which shouldn't be an issue anyway as in theory I should be locking it down and ensuring that authorization happens on every action in my application by adding <code>check_authorization</code> to my <code>ApplicationController</code>. According to <a href="https://github.com/CanCanCommunity/cancancan" rel="nofollow noreferrer">the CanCanCan documentation</a>:</p>
  
  <blockquote>
    <p>This will raise an exception if authorization is <strong>not</strong> performed in an
    action.</p>
  </blockquote>
  
  <p><strong>Problem</strong></p>
  
  <p>The issue I'm having is that check_authorization doesn't appear to be locking down the actions for non RESTful controllers. Actions that don't declare authorize! are being executed without raising any AccessDenied exceptions.</p>
  
  <p>Below is an MCVE that represents what I am doing. Am I doing something wrong or have I discovered a bug? What is the 'right' way to do this?</p>
  
  <p><strong>Implementation</strong></p>
  
  <pre><code>class ApplicationController &lt; ActionController::Base
    protect_from_forgery with: :exception
    check_authorization
  
    def current_user
      Object.new
    end
  
    protected
  
    rescue_from CanCan::AccessDenied do |exception|
      puts "CanCan::AccessDenied Exception thrown : message=#{exception.message}"
    end
  end
  </code></pre>
  
  <p>Within my controller I'm trying to manually authorize but only if certain conditions are met:</p>
  
  <pre><code>class FooController &lt; ApplicationController
    def new
      authorize! :foo, :bar, unless: true
      puts 'FooController#new'
    end
  
    def index
      authorize! :foo, :bar, if: true
      puts 'FooController#index'
    end
  
    def show
      puts 'FooController#show'
    end
  end
  </code></pre>
  
  <p>And the Ability class that enables the :foo :bar authorization:</p>
  
  <pre><code>class Ability
    include CanCan::Ability
  
    def initialize(user)
      puts 'CanCan::Ability#initialise'
      can :foo, :bar
    end
  end
  </code></pre>
  
  <p>Output generated in Rails console:</p>
  
  <pre><code>2.3.0 :001 &gt; app.get '/foo/new'
  CanCan::Ability#initialise
  FooController#new
  
  2.3.0 :002 &gt; app.get '/foo'
  CanCan::Ability#initialise
  FooController#index
  
  2.3.0 :001 &gt; app.get '/foo/1'
  FooController#show
  </code></pre>
  
  <p>Note, that the <code>show</code> action doesn't even have the <code>authorize!</code> declaration, yet still allows execution without throwing an exception.</p>
  
  <p>Also, what I don't understand is that <code>Ability#initialize</code> isn't called at all for the <code>show</code> action. To add to my confusion - the <code>Ability#initialize</code> method is called for both <code>new</code> and <code>index</code> - you would expect one of them to have the same behaviour as the <code>show</code> action, given that the <code>new</code> action shouldn't be invoking the <code>authorize!</code> method.</p>