How to define instance capabilities in cancan without defining class capabilities?

How to define instance capabilities in cancan without defining class capabilities?

I want to allow action :manage

for specific instances Course

, not Course

class .

# ability.rb
can :manage, Course do |course|
  # Check if the user is a helper for this course
  CourseRole.get_role(user, course) == "helper"
end

      

        
        
        
      

    

This works great, for example variables:

# some_view.rb
can? :manage, @course # checks the instance to see if :manage is allowed

      

        
        
        
      

    

But if I do this:

# some_view.rb
can? :manage, Course 

      

        
        
        
      

    

it always returns true which is bad.

In some context:

class User < ActiveRecord::Base
  has_many :course_roles
  has_many :courses, :through => :course_roles
  ...
class CourseRoles < ActiveRecord::Base
  belongs_to :user
  belongs_to :course
  ...
class Courses < ActiveRecord::Base
  has_many :course_roles
  has_many :users, :through => :course_roles