title: Why does declarative_authorization break the functionality of my controller? - Rails 3
body: <p>I have a <code>Coupons</code> controller with two actions.</p>
  
  <pre><code>class CouponsController &lt; ApplicationController
    filter_resource_access
  
    def index
      @coupons = Coupon.all
    end
  
    #generates 10 new coupons on each call
    def generate
      plan_id = params[:plan_id]
      numdays = params[:num_days]
  
      (1..10).each do |i|
        validChars = %w{ 1 2 3 4 5 6 7 9 a A b B d D e E f g G h H j J k K m M n N p P q Q r R t T }.to_a
  
        code = (0...6).map{ validChars[ rand(validChars.size) ] }.join
  
        coupon = Coupon.new
        coupon.code = code
        coupon.plan_id = plan_id
        coupon.active = false
        coupon.subdays = numdays
        coupon.save
      end
      redirect_to :coupons_path
    end
  
  end
  </code></pre>
  
  <p>The generate action is invoked in my view like this:</p>
  
  <pre><code>&lt;h2 class="page-title"&gt;Coupons&lt;/h2&gt;
  &lt;div class="main"&gt;
     &lt;%= form_tag "coupons/generate" do -%&gt;
          &lt;%= hidden_field_tag 'user[plan_id]', "1" %&gt;
          &lt;%= hidden_field_tag 'user[num_days]', "150" %&gt;
        &lt;%= submit_tag "Generate 10 Coupons!", :class =&gt; "primary button" %&gt;
     &lt;% end -%&gt;
      &lt;table border="0" class="list"&gt;
          &lt;thead&gt;
              &lt;tr&gt;
                  &lt;th&gt;Code&lt;/th&gt;&lt;th&gt;Plan&lt;/th&gt;&lt;th&gt;Duration&lt;/th&gt;&lt;th&gt;Activated&lt;/th&gt;
              &lt;/tr&gt;
          &lt;/thead&gt;
          &lt;tbody&gt;
          &lt;% if !@coupons.nil? %&gt;
              &lt;% @coupons.each do |coupon| %&gt;
              &lt;tr class="&lt;%#= list_entry or list_entry_alt %&gt;"&gt;
                  &lt;td&gt;&lt;%= coupon.code %&gt;&lt;/td&gt;
                  &lt;td&gt;&lt;%= coupon.plan_id  %&gt;&lt;/td&gt;
                  &lt;td&gt;&lt;%= coupon.subdays %&gt; days&lt;/td&gt;
                  &lt;td&gt;&lt;% if coupon.started.nil? == true  %&gt;
                      &lt;%= 'Not yet' %&gt;
                      &lt;% else %&gt;
                      &lt;%= time_ago_or_time_stamp coupon.started %&gt;
                      &lt;% end %&gt;
                      &lt;/td&gt;
              &lt;/tr&gt;
              &lt;% end %&gt;
          &lt;% end %&gt;
          &lt;/tbody&gt;
       &lt;/table&gt;
  &lt;/div&gt;
  </code></pre>
  
  <p>My <code>config/authorization_rules.rb</code> looks like this:</p>
  
  <pre><code>has_permission_on [:coupons], :to =&gt; [:index, :show, :step, :new, :create, :edit, :update, :destroy, :generate]
  </code></pre>
  
  <p>The error all of the above throws is this:</p>
  
  <pre><code>filter_access_to tried to find Coupon from params[:id] (nil), because attribute_check is enabled and @coupon isn't set, but failed: ActiveRecord::RecordNotFound: Couldn't find Coupon without an ID
  Completed 404 Not Found in 245ms
  
  ActiveRecord::RecordNotFound (Couldn't find Coupon without an ID):
  </code></pre>
  
  <p>However, once I change the <code>filter_resource_access</code> to <code>filter_access_to :all, :except =&gt; :generate</code> it doesn't give me the error anymore and kinda works.</p>
  
  <p>i.e. it produces some of the coupon codes that I am looking for, but it doesn't include the plan_id number or the number of days in the output in the view.</p>
  
  <p>Why is that? What am I doing wrong?</p>
  
  <p>Edit 1: By the way, it does restrict the right people...i.e. only the specified roles can view the <code>coupons index view</code>. So the filter partly works. </p>