pundit 2.1.0 → 2.5.0

data/spec/spec_helper.rb

@@ -1,271 +1,35 @@
 # frozen_string_literal: true
 
+if ENV["COVERAGE"]
+  require "simplecov"
+  require "simplecov_json_formatter"
+  require_relative "simple_cov_check_action_formatter"
+  SimpleCov.formatters = SimpleCov::Formatter::MultiFormatter.new([
+    SimpleCov::Formatter::HTMLFormatter,
+    SimpleCov::Formatter::JSONFormatter,
+    SimpleCovCheckActionFormatter.with_options(
+      output_filename: "simplecov-check-action.json"
+    )
+  ])
+  SimpleCov.start do
+    add_filter "/spec/"
+    enable_coverage :branch
+    primary_coverage :branch
+  end
+end
+
+# @see https://github.com/rails/rails/issues/54260
+require "logger" if RUBY_ENGINE == "jruby" && RUBY_ENGINE_VERSION.start_with?("9.3")
+
 require "pundit"
 require "pundit/rspec"
-
-require "rack"
-require "rack/test"
-require "pry"
-require "active_support"
-require "active_support/core_ext"
 require "active_model/naming"
-require "action_controller/metal/strong_parameters"
-
-I18n.enforce_available_locales = false
-
-module PunditSpecHelper
-  extend RSpec::Matchers::DSL
-
-  matcher :be_truthy do
-    match do |actual|
-      actual
-    end
-  end
-end
-
-RSpec.configure do |config|
-  config.include PunditSpecHelper
-end
-
-class PostPolicy < Struct.new(:user, :post)
-  class Scope < Struct.new(:user, :scope)
-    def resolve
-      scope.published
-    end
-  end
-
-  def update?
-    post.user == user
-  end
-
-  def destroy?
-    false
-  end
-
-  def show?
-    true
-  end
-
-  def permitted_attributes
-    if post.user == user
-      %i[title votes]
-    else
-      [:votes]
-    end
-  end
-
-  def permitted_attributes_for_revise
-    [:body]
-  end
-end
-
-class Post < Struct.new(:user)
-  def self.published
-    :published
-  end
-
-  def self.read
-    :read
-  end
-
-  def to_s
-    "Post"
-  end
-
-  def inspect
-    "#<Post>"
-  end
-end
-
-module Customer
-  class Post < Post
-    def model_name
-      OpenStruct.new(param_key: "customer_post")
-    end
-
-    def self.policy_class
-      PostPolicy
-    end
-
-    def policy_class
-      self.class.policy_class
-    end
-  end
-end
-
-class CommentScope
-  attr_reader :original_object
-  def initialize(original_object)
-    @original_object = original_object
-  end
-
-  def ==(other)
-    original_object == other.original_object
-  end
-end
-
-class CommentPolicy < Struct.new(:user, :comment)
-  class Scope < Struct.new(:user, :scope)
-    def resolve
-      CommentScope.new(scope)
-    end
-  end
-end
-
-class PublicationPolicy < Struct.new(:user, :publication)
-  class Scope < Struct.new(:user, :scope)
-    def resolve
-      scope.published
-    end
-  end
-
-  def create?
-    true
-  end
-end
-
-class Comment
-  extend ActiveModel::Naming
-end
-
-class CommentsRelation
-  def initialize(empty = false)
-    @empty = empty
-  end
-
-  def blank?
-    @empty
-  end
 
-  def model_name
-    Comment.model_name
-  end
-end
-
-class Article; end
-
-class BlogPolicy < Struct.new(:user, :blog); end
-
-class Blog; end
-
-class ArtificialBlog < Blog
-  def self.policy_class
-    BlogPolicy
-  end
-end
-
-class ArticleTagOtherNamePolicy < Struct.new(:user, :tag)
-  def show?
-    true
-  end
-
-  def destroy?
-    false
-  end
-end
-
-class ArticleTag
-  def self.policy_class
-    ArticleTagOtherNamePolicy
-  end
-end
-
-class CriteriaPolicy < Struct.new(:user, :criteria); end
-
-module Project
-  class CommentPolicy < Struct.new(:user, :comment)
-    class Scope < Struct.new(:user, :scope)
-      def resolve
-        scope
-      end
-    end
-  end
-
-  class CriteriaPolicy < Struct.new(:user, :criteria); end
-
-  class PostPolicy < Struct.new(:user, :post)
-    class Scope < Struct.new(:user, :scope)
-      def resolve
-        scope.read
-      end
-    end
-  end
-end
-
-class DenierPolicy < Struct.new(:user, :record)
-  def update?
-    false
-  end
-end
-
-class Controller
-  include Pundit
-  # Mark protected methods public so they may be called in test
-  # rubocop:disable Layout/AccessModifierIndentation, Style/AccessModifierDeclarations
-  public(*Pundit.protected_instance_methods)
-  # rubocop:enable Layout/AccessModifierIndentation, Style/AccessModifierDeclarations
-
-  attr_reader :current_user, :action_name, :params
-
-  def initialize(current_user, action_name, params)
-    @current_user = current_user
-    @action_name = action_name
-    @params = params
-  end
-end
-
-class NilClassPolicy < Struct.new(:user, :record)
-  class Scope
-    def initialize(*)
-      raise Pundit::NotDefinedError, "Cannot scope NilClass"
-    end
-  end
-
-  def show?
-    false
-  end
-
-  def destroy?
-    false
-  end
-end
-
-class Wiki; end
-class WikiPolicy
-  class Scope
-    # deliberate typo method
-    def initalize; end
-  end
-end
-
-class Thread
-  def self.all; end
-end
-class ThreadPolicy < Struct.new(:user, :thread)
-  class Scope < Struct.new(:user, :scope)
-    def resolve
-      # deliberate wrong useage of the method
-      scope.all(:unvalid, :parameters)
-    end
-  end
-end
-
-class PostFourFiveSix < Struct.new(:user); end
-
-class CommentFourFiveSix; extend ActiveModel::Naming; end
-
-module ProjectOneTwoThree
-  class CommentFourFiveSixPolicy < Struct.new(:user, :post); end
-
-  class CriteriaFourFiveSixPolicy < Struct.new(:user, :criteria); end
-
-  class PostFourFiveSixPolicy < Struct.new(:user, :post); end
-
-  class TagFourFiveSix < Struct.new(:user); end
-
-  class TagFourFiveSixPolicy < Struct.new(:user, :tag); end
-
-  class AvatarFourFiveSix; extend ActiveModel::Naming; end
-
-  class AvatarFourFiveSixPolicy < Struct.new(:user, :avatar); end
-end
+# Load all supporting files: models, policies, etc.
+require "zeitwerk"
+loader = Zeitwerk::Loader.new
+loader.push_dir(File.expand_path("support/models", __dir__))
+loader.push_dir(File.expand_path("support/policies", __dir__))
+loader.push_dir(File.expand_path("support/lib", __dir__))
+loader.setup
+loader.eager_load

data/spec/support/lib/controller.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+class Controller
+  attr_accessor :current_user
+  attr_reader :action_name, :params
+
+  class View
+    def initialize(controller)
+      @controller = controller
+    end
+
+    attr_reader :controller
+  end
+
+  class << self
+    def helper(mod)
+      View.include(mod)
+    end
+
+    def helper_method(method)
+      View.class_eval <<-RUBY, __FILE__, __LINE__ + 1
+        def #{method}(*args, **kwargs, &block)
+          controller.send(:#{method}, *args, **kwargs, &block)
+        end
+      RUBY
+    end
+  end
+
+  include Pundit::Authorization
+  # Mark protected methods public so they may be called in test
+  public(*Pundit::Authorization.protected_instance_methods)
+
+  def initialize(current_user, action_name, params)
+    @current_user = current_user
+    @action_name = action_name
+    @params = params
+  end
+end

data/spec/support/lib/custom_cache.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+class CustomCache
+  def initialize
+    @store = {}
+  end
+
+  def to_h
+    @store
+  end
+
+  def [](key)
+    @store[key]
+  end
+
+  def []=(key, value)
+    @store[key] = value
+  end
+end

data/spec/support/lib/instance_tracking.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+module InstanceTracking
+  module ClassMethods
+    def instances
+      @instances || 0
+    end
+
+    attr_writer :instances
+  end
+
+  def self.prepended(other)
+    other.extend(ClassMethods)
+  end
+
+  def initialize(*args, **kwargs, &block)
+    self.class.instances += 1
+    super(*args, **kwargs, &block)
+  end
+end

data/spec/support/models/article.rb

@@ -0,0 +1,4 @@
+# frozen_string_literal: true
+
+class Article
+end

data/spec/support/models/article_tag.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+class ArticleTag
+  def self.policy_class
+    ArticleTagOtherNamePolicy
+  end
+end

data/spec/support/models/artificial_blog.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+class ArtificialBlog < Blog
+  def self.policy_class
+    BlogPolicy
+  end
+end

data/spec/support/models/blog.rb

@@ -0,0 +1,4 @@
+# frozen_string_literal: true
+
+class Blog
+end

data/spec/support/models/comment.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+class Comment
+  extend ActiveModel::Naming
+end

data/spec/support/models/comment_four_five_six.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+class CommentFourFiveSix
+  extend ActiveModel::Naming
+end

data/spec/support/models/comment_scope.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+class CommentScope
+  attr_reader :original_object
+
+  def initialize(original_object)
+    @original_object = original_object
+  end
+
+  def ==(other)
+    original_object == other.original_object
+  end
+end

data/spec/support/models/comments_relation.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+class CommentsRelation
+  def initialize(empty: false)
+    @empty = empty
+  end
+
+  def blank?
+    @empty
+  end
+
+  def self.model_name
+    Comment.model_name
+  end
+end

data/spec/support/models/customer/post.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module Customer
+  class Post < ::Post
+    extend ActiveModel::Naming
+
+    def self.policy_class
+      PostPolicy
+    end
+  end
+end

data/spec/support/models/default_scope_contains_error.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+class DefaultScopeContainsError
+  def self.all; end
+end

data/spec/support/models/dummy_current_user.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+class DummyCurrentUser
+  def update?
+    user
+  end
+end

data/spec/support/models/foo.rb

@@ -0,0 +1,4 @@
+# frozen_string_literal: true
+
+class Foo
+end

data/spec/support/models/post.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+class Post
+  def initialize(user = nil)
+    @user = user
+  end
+
+  attr_reader :user
+
+  def self.published
+    :published
+  end
+
+  def self.read
+    :read
+  end
+
+  def to_s
+    "Post"
+  end
+
+  def inspect
+    "#<Post>"
+  end
+end

data/spec/support/models/post_four_five_six.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+class PostFourFiveSix
+  def initialize(user)
+    @user = user
+  end
+
+  attr_reader(:user)
+end

data/spec/support/models/project_one_two_three/avatar_four_five_six.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+module ProjectOneTwoThree
+  class AvatarFourFiveSix
+    extend ActiveModel::Naming
+  end
+end

data/spec/support/models/project_one_two_three/tag_four_five_six.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module ProjectOneTwoThree
+  class TagFourFiveSix
+    def initialize(user)
+      @user = user
+    end
+
+    attr_reader(:user)
+  end
+end

data/spec/support/models/wiki.rb

@@ -0,0 +1,4 @@
+# frozen_string_literal: true
+
+class Wiki
+end

data/spec/support/policies/article_tag_other_name_policy.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+class ArticleTagOtherNamePolicy < BasePolicy
+  def show?
+    true
+  end
+
+  def destroy?
+    false
+  end
+
+  alias tag record
+end

data/spec/support/policies/base_policy.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+class BasePolicy
+  prepend InstanceTracking
+
+  class BaseScope
+    prepend InstanceTracking
+
+    def initialize(user, scope)
+      @user = user
+      @scope = scope
+    end
+
+    attr_reader :user, :scope
+  end
+
+  def initialize(user, record)
+    @user = user
+    @record = record
+  end
+
+  attr_reader :user, :record
+end

data/spec/support/policies/blog_policy.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+class BlogPolicy < BasePolicy
+  alias blog record
+end

data/spec/support/policies/comment_policy.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+class CommentPolicy < BasePolicy
+  class Scope < BaseScope
+    def resolve
+      CommentScope.new(scope)
+    end
+  end
+
+  alias comment record
+end

data/spec/support/policies/criteria_policy.rb

@@ -0,0 +1,5 @@
+# frozen_string_literal: true
+
+class CriteriaPolicy < BasePolicy
+  alias criteria record
+end

data/spec/support/policies/default_scope_contains_error_policy.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+class DefaultScopeContainsErrorPolicy < BasePolicy
+  class Scope < BaseScope
+    def resolve
+      # deliberate wrong usage of the method
+      raise "This is an arbitrary error that should bubble up"
+    end
+  end
+end

data/spec/support/policies/denier_policy.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+class DenierPolicy < BasePolicy
+  def update?
+    false
+  end
+end

data/spec/support/policies/dummy_current_user_policy.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+class DummyCurrentUserPolicy < BasePolicy
+  class Scope < BasePolicy::BaseScope
+    def resolve
+      user
+    end
+  end
+end

data/spec/support/policies/nil_class_policy.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+class NilClassPolicy < BasePolicy
+  class Scope
+    def initialize(*)
+      raise Pundit::NotDefinedError, "Cannot scope NilClass"
+    end
+  end
+
+  def show?
+    false
+  end
+
+  def destroy?
+    false
+  end
+end