title: CanCan ability on association
body: <p>My question is about defining cancancan ability in this following context.</p>
  
  <p>I have a common model with many to many relationship between User and Company entities</p>
  
  <pre><code>class User &lt; ApplicationRecord
      has_many :company_users, dependent: :destroy
      has_many :companies, through: :company_users 
      enum role:[:user, :admin, :superadmin]
  end
  
  class Company &lt; ApplicationRecord
      has_many :company_users, dependent: :destroy
      has_many :users, through: :company_users
  end
  
  class CompanyUser &lt; ApplicationRecord
      belongs_to :company
      belongs_to :user
  end
  </code></pre>
  
  <p>I want now to define cancan ability in order to authorized current user to manage all the users belonging to the same companies as him.</p>
  
  <p>I have no problem with other many to many schemas (eg : many to many between Device and Company) like this</p>
  
  <pre><code>can :manage, Device, :companies =&gt; {:users =&gt; {:id =&gt; user.id}}
  </code></pre>
  
  <p>is working fine !</p>
  
  <p>but</p>
  
  <pre><code>can :manage, User, :companies =&gt; {:users =&gt; {:id =&gt; user.id}}
  </code></pre>
  
  <p>let me see, of course, only the current user because it is on the same users table.</p>
  
  <p>How can I manage easily this ability between users belonging to a same company preserving the many to many relationship ?</p>
  
  <p>Thanks for your help</p>