pundit 1.1.0 → 2.1.0

data/lib/pundit/rspec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "active_support/core_ext/array/conversions"
 
 module Pundit
@@ -5,10 +7,11 @@ module Pundit
     module Matchers
       extend ::RSpec::Matchers::DSL
 
+      # rubocop:disable Metrics/BlockLength
       matcher :permit do |user, record|
         match_proc = lambda do |policy|
           @violating_permissions = permissions.find_all do |permission|
-            not policy.new(user, record).public_send(permission)
+            !policy.new(user, record).public_send(permission)
           end
           @violating_permissions.empty?
         end
@@ -22,14 +25,14 @@ module Pundit
 
         failure_message_proc = lambda do |policy|
           was_were = @violating_permissions.count > 1 ? "were" : "was"
-          "Expected #{policy} to grant #{permissions.to_sentence} on \
-          #{record} but #{@violating_permissions.to_sentence} #{was_were} not granted"
+          "Expected #{policy} to grant #{permissions.to_sentence} on " \
+          "#{record} but #{@violating_permissions.to_sentence} #{was_were} not granted"
         end
 
         failure_message_when_negated_proc = lambda do |policy|
           was_were = @violating_permissions.count > 1 ? "were" : "was"
-          "Expected #{policy} not to grant #{permissions.to_sentence} on \
-          #{record} but #{@violating_permissions.to_sentence} #{was_were} granted"
+          "Expected #{policy} not to grant #{permissions.to_sentence} on " \
+          "#{record} but #{@violating_permissions.to_sentence} #{was_were} granted"
         end
 
         if respond_to?(:match_when_negated)
@@ -49,6 +52,7 @@ module Pundit
           current_example.metadata[:permissions]
         end
       end
+      # rubocop:enable Metrics/BlockLength
     end
 
     module DSL
@@ -71,12 +75,14 @@ end
 
 RSpec.configure do |config|
   if RSpec::Core::Version::STRING.split(".").first.to_i >= 3
-    config.include(Pundit::RSpec::PolicyExampleGroup,
+    config.include(
+      Pundit::RSpec::PolicyExampleGroup,
       type: :policy,
       file_path: %r{spec/policies}
     )
   else
-    config.include(Pundit::RSpec::PolicyExampleGroup,
+    config.include(
+      Pundit::RSpec::PolicyExampleGroup,
       type: :policy,
       example_group: { file_path: %r{spec/policies} }
     )

data/lib/pundit/version.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 module Pundit
-  VERSION = "1.1.0"
+  VERSION = "2.1.0".freeze
 end

data/pundit.gemspec

@@ -1,30 +1,31 @@
-# -*- encoding: utf-8 -*-
-lib = File.expand_path("../lib", __FILE__)
+# frozen_string_literal: true
+
+lib = File.expand_path("lib", __dir__)
 $LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
 require "pundit/version"
 
 Gem::Specification.new do |gem|
   gem.name          = "pundit"
   gem.version       = Pundit::VERSION
-  gem.authors       = ["Jonas Nicklas", "Elabs AB"]
+  gem.authors       = ["Jonas Nicklas", "Varvet AB"]
   gem.email         = ["jonas.nicklas@gmail.com", "dev@elabs.se"]
   gem.description   = "Object oriented authorization for Rails applications"
   gem.summary       = "OO authorization for Rails"
-  gem.homepage      = "https://github.com/elabs/pundit"
+  gem.homepage      = "https://github.com/varvet/pundit"
   gem.license       = "MIT"
 
-  gem.files         = `git ls-files`.split($/)
+  gem.files         = `git ls-files`.split($INPUT_RECORD_SEPARATOR)
   gem.executables   = gem.files.grep(%r{^bin/}).map { |f| File.basename(f) }
   gem.test_files    = gem.files.grep(%r{^(test|spec|features)/})
   gem.require_paths = ["lib"]
 
   gem.add_dependency "activesupport", ">= 3.0.0"
-  gem.add_development_dependency "activemodel", ">= 3.0.0"
   gem.add_development_dependency "actionpack", ">= 3.0.0"
-  gem.add_development_dependency "bundler", "~> 1.3"
-  gem.add_development_dependency "rspec", ">=2.0.0"
+  gem.add_development_dependency "activemodel", ">= 3.0.0"
+  gem.add_development_dependency "bundler"
   gem.add_development_dependency "pry"
   gem.add_development_dependency "rake"
+  gem.add_development_dependency "rspec", ">= 2.0.0"
+  gem.add_development_dependency "rubocop", "0.57.2"
   gem.add_development_dependency "yard"
-  gem.add_development_dependency "rubocop"
 end

data/spec/policies/post_policy_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "spec_helper"
 
 describe PostPolicy do

data/spec/policy_finder_spec.rb

@@ -0,0 +1,124 @@
+# frozen_string_literal: true
+
+require "spec_helper"
+
+describe Pundit::PolicyFinder do
+  let(:user) { double }
+  let(:post) { Post.new(user) }
+  let(:comment) { CommentFourFiveSix.new }
+  let(:article) { Article.new }
+
+  describe "#scope" do
+    subject { described_class.new(post) }
+
+    it "returns a policy scope" do
+      expect(subject.scope).to eq PostPolicy::Scope
+    end
+
+    context "policy is nil" do
+      it "returns nil" do
+        allow(subject).to receive(:policy).and_return nil
+        expect(subject.scope).to eq nil
+      end
+    end
+  end
+
+  describe "#policy" do
+    subject { described_class.new(post) }
+
+    it "returns a policy" do
+      expect(subject.policy).to eq PostPolicy
+    end
+
+    context "with a string" do
+      it "returns a policy" do
+        allow(subject).to receive(:find).and_return "PostPolicy"
+        expect(subject.policy).to eq PostPolicy
+      end
+    end
+
+    context "with a class" do
+      it "returns a policy" do
+        allow(subject).to receive(:find).and_return PostPolicy
+        expect(subject.policy).to eq PostPolicy
+      end
+    end
+
+    context "with nil" do
+      it "returns nil" do
+        allow(subject).to receive(:find).and_return nil
+        expect(subject.policy).to eq nil
+      end
+    end
+
+    context "with a string that can't be constantized" do
+      it "returns nil" do
+        allow(subject).to receive(:find).and_return "FooPolicy"
+        expect(subject.policy).to eq nil
+      end
+    end
+  end
+
+  describe "#scope!" do
+    context "@object is nil" do
+      subject { described_class.new(nil) }
+
+      it "returns the NilClass policy's scope class" do
+        expect(subject.scope!).to eq NilClassPolicy::Scope
+      end
+    end
+
+    context "@object is defined" do
+      subject { described_class.new(post) }
+
+      it "returns the scope" do
+        expect(subject.scope!).to eq PostPolicy::Scope
+      end
+    end
+  end
+
+  describe "#param_key" do
+    context "object responds to model_name" do
+      subject { described_class.new(comment) }
+
+      it "returns the param_key" do
+        expect(subject.object).to respond_to(:model_name)
+        expect(subject.param_key).to eq "comment_four_five_six"
+      end
+    end
+
+    context "object is a class" do
+      subject { described_class.new(Article) }
+
+      it "returns the param_key" do
+        expect(subject.object).not_to respond_to(:model_name)
+        expect(subject.object).to be_a Class
+        expect(subject.param_key).to eq "article"
+      end
+    end
+
+    context "object is an instance of a class" do
+      subject { described_class.new(article) }
+
+      it "returns the param_key" do
+        expect(subject.object).not_to respond_to(:model_name)
+        expect(subject.object).not_to be_a Class
+        expect(subject.object).to be_an_instance_of Article
+
+        expect(subject.param_key).to eq "article"
+      end
+    end
+
+    context "object is an array" do
+      subject { described_class.new([:project, article]) }
+
+      it "returns the param_key for the last element of the array" do
+        expect(subject.object).not_to respond_to(:model_name)
+        expect(subject.object).not_to be_a Class
+        expect(subject.object).to be_an_instance_of Array
+
+        expect(subject.param_key).to eq "article"
+      end
+    end
+  end
+end

data/spec/pundit_spec.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require "spec_helper"
 
 describe Pundit do
@@ -8,19 +10,25 @@ describe Pundit do
   let(:comment) { Comment.new }
   let(:comment_four_five_six) { CommentFourFiveSix.new }
   let(:article) { Article.new }
-  let(:controller) { Controller.new(user, action: "update") }
+  let(:controller) { Controller.new(user, "update", {}) }
   let(:artificial_blog) { ArtificialBlog.new }
   let(:article_tag) { ArticleTag.new }
   let(:comments_relation) { CommentsRelation.new }
   let(:empty_comments_relation) { CommentsRelation.new(true) }
   let(:tag_four_five_six) { ProjectOneTwoThree::TagFourFiveSix.new(user) }
   let(:avatar_four_five_six) { ProjectOneTwoThree::AvatarFourFiveSix.new }
+  let(:wiki) { Wiki.new }
+  let(:thread) { Thread.new }
 
   describe ".authorize" do
     it "infers the policy and authorizes based on it" do
       expect(Pundit.authorize(user, post, :update?)).to be_truthy
     end
 
+    it "can be given a different policy class" do
+      expect(Pundit.authorize(user, post, :create?, policy_class: PublicationPolicy)).to be_truthy
+    end
+
     it "works with anonymous class policies" do
       expect(Pundit.authorize(user, article_tag, :show?)).to be_truthy
       expect { Pundit.authorize(user, article_tag, :destroy?) }.to raise_error(Pundit::NotAuthorizedError)
@@ -30,11 +38,18 @@ describe Pundit do
       # rubocop:disable Style/MultilineBlockChain
       expect do
         Pundit.authorize(user, post, :destroy?)
-      end.to raise_error(Pundit::NotAuthorizedError, "not allowed to destroy? this #<Post>") do |error|
+      end.to raise_error(Pundit::NotAuthorizedError, "not allowed to destroy? this Post") do |error|
         expect(error.query).to eq :destroy?
         expect(error.record).to eq post
         expect(error.policy).to eq Pundit.policy(user, post)
       end
+      # rubocop:enable Style/MultilineBlockChain
+    end
+
+    it "raises an error with a invalid policy constructor" do
+      expect do
+        Pundit.authorize(user, wiki, :update?)
+      end.to raise_error(Pundit::InvalidConstructorError, "Invalid #<WikiPolicy> constructor is called")
     end
   end
 
@@ -44,23 +59,43 @@ describe Pundit do
     end
 
     it "returns an instantiated policy scope given an active model class" do
-      expect(Pundit.policy_scope(user, Comment)).to eq Comment
+      expect(Pundit.policy_scope(user, Comment)).to eq CommentScope.new(Comment)
     end
 
     it "returns an instantiated policy scope given an active record relation" do
-      expect(Pundit.policy_scope(user, comments_relation)).to eq comments_relation
+      expect(Pundit.policy_scope(user, comments_relation)).to eq CommentScope.new(comments_relation)
     end
 
     it "returns an instantiated policy scope given an empty active record relation" do
-      expect(Pundit.policy_scope(user, empty_comments_relation)).to eq empty_comments_relation
+      expect(Pundit.policy_scope(user, empty_comments_relation)).to eq CommentScope.new(empty_comments_relation)
+    end
+
+    it "returns an instantiated policy scope given an array of a symbol and plain model class" do
+      expect(Pundit.policy_scope(user, [:project, Post])).to eq :read
+    end
+
+    it "returns an instantiated policy scope given an array of a symbol and active model class" do
+      expect(Pundit.policy_scope(user, [:project, Comment])).to eq Comment
     end
 
     it "returns nil if the given policy scope can't be found" do
       expect(Pundit.policy_scope(user, Article)).to be_nil
     end
 
-    it "returns nil if blank object given" do
-      expect(Pundit.policy_scope(user, nil)).to be_nil
+    it "raises an exception if nil object given" do
+      expect { Pundit.policy_scope(user, nil) }.to raise_error(Pundit::NotDefinedError)
+    end
+
+    it "raises an error with a invalid policy scope constructor" do
+      expect do
+        Pundit.policy_scope(user, Wiki)
+      end.to raise_error(Pundit::InvalidConstructorError, "Invalid #<WikiPolicy::Scope> constructor is called")
+    end
+
+    it "raises an original error with a policy scope that contains error" do
+      expect do
+        Pundit.policy_scope(user, Thread)
+      end.to raise_error(ArgumentError)
     end
   end
 
@@ -70,7 +105,7 @@ describe Pundit do
     end
 
     it "returns an instantiated policy scope given an active model class" do
-      expect(Pundit.policy_scope!(user, Comment)).to eq Comment
+      expect(Pundit.policy_scope!(user, Comment)).to eq CommentScope.new(Comment)
     end
 
     it "throws an exception if the given policy scope can't be found" do
@@ -84,7 +119,21 @@ describe Pundit do
     it "throws an exception if the given policy scope is nil" do
       expect do
         Pundit.policy_scope!(user, nil)
-      end.to raise_error(Pundit::NotDefinedError, "unable to find policy scope of nil")
+      end.to raise_error(Pundit::NotDefinedError, "Cannot scope NilClass")
+    end
+
+    it "returns an instantiated policy scope given an array of a symbol and plain model class" do
+      expect(Pundit.policy_scope!(user, [:project, Post])).to eq :read
+    end
+
+    it "returns an instantiated policy scope given an array of a symbol and active model class" do
+      expect(Pundit.policy_scope!(user, [:project, Comment])).to eq Comment
+    end
+
+    it "raises an error with a invalid policy scope constructor" do
+      expect do
+        Pundit.policy_scope(user, Wiki)
+      end.to raise_error(Pundit::InvalidConstructorError, "Invalid #<WikiPolicy::Scope> constructor is called")
     end
   end
 
@@ -121,42 +170,62 @@ describe Pundit do
     end
 
     it "returns an instantiated policy given an array of symbols" do
-      policy = Pundit.policy(user, [:project, :criteria])
+      policy = Pundit.policy(user, %i[project criteria])
       expect(policy.class).to eq Project::CriteriaPolicy
       expect(policy.user).to eq user
-      expect(policy.criteria).to eq [:project, :criteria]
+      expect(policy.criteria).to eq :criteria
     end
 
     it "returns an instantiated policy given an array of a symbol and plain model instance" do
       policy = Pundit.policy(user, [:project, post])
       expect(policy.class).to eq Project::PostPolicy
       expect(policy.user).to eq user
-      expect(policy.post).to eq [:project, post]
+      expect(policy.post).to eq post
+    end
+
+    it "returns an instantiated policy given an array of a symbol and a model instance with policy_class override" do
+      policy = Pundit.policy(user, [:project, customer_post])
+      expect(policy.class).to eq Project::PostPolicy
+      expect(policy.user).to eq user
+      expect(policy.post).to eq customer_post
     end
 
     it "returns an instantiated policy given an array of a symbol and an active model instance" do
       policy = Pundit.policy(user, [:project, comment])
       expect(policy.class).to eq Project::CommentPolicy
       expect(policy.user).to eq user
-      expect(policy.post).to eq [:project, comment]
+      expect(policy.comment).to eq comment
     end
 
     it "returns an instantiated policy given an array of a symbol and a plain model class" do
       policy = Pundit.policy(user, [:project, Post])
       expect(policy.class).to eq Project::PostPolicy
       expect(policy.user).to eq user
-      expect(policy.post).to eq [:project, Post]
+      expect(policy.post).to eq Post
+    end
+
+    it "raises an error with a invalid policy constructor" do
+      expect do
+        Pundit.policy(user, Wiki)
+      end.to raise_error(Pundit::InvalidConstructorError, "Invalid #<WikiPolicy> constructor is called")
     end
 
     it "returns an instantiated policy given an array of a symbol and an active model class" do
       policy = Pundit.policy(user, [:project, Comment])
       expect(policy.class).to eq Project::CommentPolicy
       expect(policy.user).to eq user
-      expect(policy.post).to eq [:project, Comment]
+      expect(policy.comment).to eq Comment
+    end
+
+    it "returns an instantiated policy given an array of a symbol and a class with policy_class override" do
+      policy = Pundit.policy(user, [:project, Customer::Post])
+      expect(policy.class).to eq Project::PostPolicy
+      expect(policy.user).to eq user
+      expect(policy.post).to eq Customer::Post
     end
 
     it "returns correct policy class for an array of a multi-word symbols" do
-      policy = Pundit.policy(user, [:project_one_two_three, :criteria_four_five_six])
+      policy = Pundit.policy(user, %i[project_one_two_three criteria_four_five_six])
       expect(policy.class).to eq ProjectOneTwoThree::CriteriaFourFiveSixPolicy
     end
 
@@ -205,8 +274,8 @@ describe Pundit do
       expect(Pundit.policy(user, Article)).to be_nil
     end
 
-    it "returns nil if the given policy is nil" do
-      expect(Pundit.policy(user, nil)).to be_nil
+    it "returns the specified NilClassPolicy for nil" do
+      expect(Pundit.policy(user, nil)).to be_a NilClassPolicy
     end
 
     describe "with .policy_class set on the model" do
@@ -269,10 +338,10 @@ describe Pundit do
     end
 
     it "returns an instantiated policy given an array of symbols" do
-      policy = Pundit.policy!(user, [:project, :criteria])
+      policy = Pundit.policy!(user, %i[project criteria])
       expect(policy.class).to eq Project::CriteriaPolicy
       expect(policy.user).to eq user
-      expect(policy.criteria).to eq [:project, :criteria]
+      expect(policy.criteria).to eq :criteria
     end
 
     it "throws an exception if the given policy can't be found" do
@@ -280,8 +349,14 @@ describe Pundit do
       expect { Pundit.policy!(user, Article) }.to raise_error(Pundit::NotDefinedError)
     end
 
-    it "throws an exception if the given policy is nil" do
-      expect { Pundit.policy!(user, nil) }.to raise_error(Pundit::NotDefinedError, "unable to find policy of nil")
+    it "returns the specified NilClassPolicy for nil" do
+      expect(Pundit.policy!(user, nil)).to be_a NilClassPolicy
+    end
+
+    it "raises an error with a invalid policy constructor" do
+      expect do
+        Pundit.policy(user, Wiki)
+      end.to raise_error(Pundit::InvalidConstructorError, "Invalid #<WikiPolicy> constructor is called")
     end
   end
 
@@ -334,11 +409,19 @@ describe Pundit do
       expect(controller.authorize(post)).to be_truthy
     end
 
+    it "returns the record on successful authorization" do
+      expect(controller.authorize(post)).to be(post)
+    end
+
     it "can be given a different permission to check" do
       expect(controller.authorize(post, :show?)).to be_truthy
       expect { controller.authorize(post, :destroy?) }.to raise_error(Pundit::NotAuthorizedError)
     end
 
+    it "can be given a different policy class" do
+      expect(controller.authorize(post, :create?, policy_class: PublicationPolicy)).to be_truthy
+    end
+
     it "works with anonymous class policies" do
       expect(controller.authorize(article_tag, :show?)).to be_truthy
       expect { controller.authorize(article_tag, :destroy?) }.to raise_error(Pundit::NotAuthorizedError)
@@ -359,7 +442,11 @@ describe Pundit do
     end
 
     it "raises an error when the given record is nil" do
-      expect { controller.authorize(nil, :destroy?) }.to raise_error(Pundit::NotDefinedError)
+      expect { controller.authorize(nil, :destroy?) }.to raise_error(Pundit::NotAuthorizedError)
+    end
+
+    it "raises an error with a invalid policy constructor" do
+      expect { controller.authorize(wiki, :destroy?) }.to raise_error(Pundit::InvalidConstructorError)
     end
   end
 
@@ -394,6 +481,10 @@ describe Pundit do
       expect { controller.policy(article) }.to raise_error(Pundit::NotDefinedError)
     end
 
+    it "raises an error with a invalid policy constructor" do
+      expect { controller.policy(wiki) }.to raise_error(Pundit::InvalidConstructorError)
+    end
+
     it "allows policy to be injected" do
       new_policy = OpenStruct.new
       controller.policies[post] = new_policy
@@ -407,10 +498,18 @@ describe Pundit do
       expect(controller.policy_scope(Post)).to eq :published
     end
 
+    it "allows policy scope class to be overriden" do
+      expect(controller.policy_scope(Post, policy_scope_class: PublicationPolicy::Scope)).to eq :published
+    end
+
     it "throws an exception if the given policy can't be found" do
       expect { controller.policy_scope(Article) }.to raise_error(Pundit::NotDefinedError)
     end
 
+    it "raises an error with a invalid policy scope constructor" do
+      expect { controller.policy_scope(Wiki) }.to raise_error(Pundit::InvalidConstructorError)
+    end
+
     it "allows policy_scope to be injected" do
       new_scope = OpenStruct.new
       controller.policy_scopes[Post] = new_scope
@@ -421,49 +520,71 @@ describe Pundit do
 
   describe "#permitted_attributes" do
     it "checks policy for permitted attributes" do
-      params = ActionController::Parameters.new(action: "update", post: {
-        title: "Hello",
-        votes: 5,
-        admin: true
-      })
+      params = ActionController::Parameters.new(
+        post: {
+          title: "Hello",
+          votes: 5,
+          admin: true
+        }
+      )
+
+      action = "update"
 
-      expect(Controller.new(user, params).permitted_attributes(post)).to eq("title" => "Hello", "votes" => 5)
-      expect(Controller.new(double, params).permitted_attributes(post)).to eq("votes" => 5)
+      expect(Controller.new(user, action, params).permitted_attributes(post).to_h).to eq(
+        "title" => "Hello",
+        "votes" => 5
+      )
+      expect(Controller.new(double, action, params).permitted_attributes(post).to_h).to eq("votes" => 5)
     end
 
     it "checks policy for permitted attributes for record of a ActiveModel type" do
-      params = ActionController::Parameters.new(action: "update", customer_post: {
-        title: "Hello",
-        votes: 5,
-        admin: true
-      })
-
-      expect(Controller.new(user, params).permitted_attributes(customer_post)).to eq("title" => "Hello", "votes" => 5)
-      expect(Controller.new(double, params).permitted_attributes(customer_post)).to eq("votes" => 5)
+      params = ActionController::Parameters.new(
+        customer_post: {
+          title: "Hello",
+          votes: 5,
+          admin: true
+        }
+      )
+
+      action = "update"
+
+      expect(Controller.new(user, action, params).permitted_attributes(customer_post).to_h).to eq(
+        "title" => "Hello",
+        "votes" => 5
+      )
+      expect(Controller.new(double, action, params).permitted_attributes(customer_post).to_h).to eq(
+        "votes" => 5
+      )
     end
   end
 
   describe "#permitted_attributes_for_action" do
     it "is checked if it is defined in the policy" do
-      params = ActionController::Parameters.new(action: "revise", post: {
-        title: "Hello",
-        body: "blah",
-        votes: 5,
-        admin: true
-      })
+      params = ActionController::Parameters.new(
+        post: {
+          title: "Hello",
+          body: "blah",
+          votes: 5,
+          admin: true
+        }
+      )
 
-      expect(Controller.new(user, params).permitted_attributes(post)).to eq("body" => "blah")
+      action = "revise"
+      expect(Controller.new(user, action, params).permitted_attributes(post).to_h).to eq("body" => "blah")
     end
 
     it "can be explicitly set" do
-      params = ActionController::Parameters.new(action: "update", post: {
-        title: "Hello",
-        body: "blah",
-        votes: 5,
-        admin: true
-      })
-
-      expect(Controller.new(user, params).permitted_attributes(post, :revise)).to eq("body" => "blah")
+      params = ActionController::Parameters.new(
+        post: {
+          title: "Hello",
+          body: "blah",
+          votes: 5,
+          admin: true
+        }
+      )
+
+      action = "update"
+      expect(Controller.new(user, action, params).permitted_attributes(post, :revise).to_h).to eq("body" => "blah")
     end
   end