Problem with user management rule in ability.rb

[joseh-henrique]

Where am I going wrong? I have a register of users, where a User with Lider rule, you can manage your users and some other actions, but do not know why, this rule does not work. Sorry for my English

ability.rb

class Ability
  include CanCan::Ability

  def initialize(user)
    user ||= User.new 

    if user.has_role? :participant
      can [:show, :update], User, id: user.id
      can :see_timestamps, User, id: user.id
    end

    if user.has_role? :leader
      Rails.logger.debug "Leader - Testing"
      can [:read, :update], User, id: user.id
      Rails.logger.info "Before Testing - User is leader"
      can :manage, User, leader_id: user.id

     # not work - always true :-( all users
      can :destroy, User, status: 0
      cannot :destroy, User, id: user.id
      cannot :confirmation, User

#      can :read, User, leader_id: user.id
#        p.try(:leader_id) == user.id
#      end
#      if user.leader_id.nil?
#        can :manage, User do |participant|
#          participant.leader_id == user.id
#        end
#        can :create, User
#        cannot :destroy, User, status: 1
# end

#      can :read, User do |participant|
#        participant.leader_id == user.id
#      end
#      can [:read, :update], User do |account|
#        account.email == user.email
#      end
#      can :see_timestamps, User, :leader_id => user.id
    end

    if user.has_role? :supervisor
      Rails.logger.debug 'Supervisor - Testing'
      can :manage, [State, City]
    end

    if user.has_role? :admin
      can :manage, :all
      end
  end
end

users_controller.rb

class UsersController < ApplicationController
  before_action :get_current_user, only: [:index,:new,:edit]
  before_action :set_user, only: [:show, :edit, :update, :destroy]

  load_and_authorize_resource

  def index
    logger.info "loading all users"
    @users = @users.includes(:occupation, :city, :kit)
  end
...
  def create
    @user = current_user.subscribers.build(user_params)
...
  end

  private

  def set_user
    @user = User.find(params[:id])
  end

  def get_current_user
    @current_user = current_user
  end

index.html.erb

<%@users.each do |user| %>
...
  <td>
    <%= link_to 'Confirm', confirm_user_path(user), data: { confirm: "Confirm #{user.name} ?"}  if can? :confirmation, User %
  </td>
  <td>
    <%= link_to 'Edit', edit_user_path(user) if  can? :edit, User %>
  </td>
  <td>
    <%= link_to 'Delete', user, method: :delete, data: { confirm: 'Confirm?' } if  can? :destroy, User %>
  </td>
...

Show debug params => permitted: false

--- !ruby/hash-with-ivars:ActionController::Parameters
elements:
  action: index
  controller: users
ivars:
  :@permitted: false

[coorasse]

Please refer to Stackoverflow for questions. Thanks.