pundit_can 0.1.2 → 0.1.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0e76045d5b38c684890accf17f380b37855a6a27ed83d379552893c1c3a2bd41
-  data.tar.gz: 5f3c777c019c7fc6e8a6a21de41f65b76f3c3c94607dbe701ecab06bb1a0bd63
+  metadata.gz: 68cee5b5723a2c0b9640e59280996fc46df7d91b3def9b26a586e13350e94788
+  data.tar.gz: 543cb75c45f2ff523c80a1339a9e474a61b65610206fa68ff5c4da5a365d2268
 SHA512:
-  metadata.gz: de3b0f7d4b32707547cd68afe69abbda6d88240a29ea29f5f1a1337606b088f18e6165844a100b681f59b687257150c53f32f23fd38ac579ee7f8fb0a851652e
-  data.tar.gz: f6b6e599bb905ff5c34ccdd6fae902b436facb1cbf4a4dd67a1cfc0cd03d07c85d557303660dd6920ea3f0c8e980a629d865fbb38758c0bc05e6e69ec5917fbd
+  metadata.gz: ac50a363d20811f5853520cebb4ab6e16cb1d0b59c91e8d81df311df97fafb36e72116c27343e723210f6024254c257ba6082744eeaa4df00f18ce893bd4a7fd
+  data.tar.gz: d6898b262559d7cd73215b8227de81e387d73257525bcde96611847c821223f54a173fcd0c016dfe4dedfdae8d503afc1b148b387c7dd13a5475e7db8244969f

data/README.md

@@ -19,25 +19,30 @@ This will load `@user` from `User` using the `UserPolicy` to authorize and scope
 
 ### Advanced usage
 
-There is support for loading multiple models. However, there isn't a `:through` option, like cancan,
-instead loading still goes through Pundit scopes.
-
 There are options to customize the loaded instance_name, model, and policy classes.
 
 #### Parent / nested
 
-This is a example of loading User and Posts.
+This is an example of loading User and Posts, where posts are scoped through the user.
 ```ruby
 class PostsController < ApplicationController
   load_resource model_class: User, parent: true
-  load_resource
+  load_resource through: :user
 
   ...
 end
 ```
 
+The `:through` option tells `load_resource` to pass the parent's association as the scope
+through the policy. For example, if `@user` was loaded by the first call, the second call
+will pass `@user.posts` to `PostPolicy::Scope` instead of `Post.all`. This allows the
+policy scope to work with the already-authorized parent.
+
 That will load `@user` from the `UserPolicy` into a `User` class, using `:user_id` to find the user.
-And it will lost `@post` or `@posts` using the `PostPolicy` with the `:id` param.
+And it will load `@post` or `@posts` using the `PostPolicy` with the `:id` param.
+
+If there is no parent instance variable set (e.g., a non-nested route), it will fall back
+to the default behavior of scoping with the model class.
 
 #### Customized loading
 

data/lib/pundit_can/load_and_authorize.rb

@@ -68,6 +68,10 @@ module PunditCan
       #
       # @param [Boolean] parent Optional. Changes the loading for parent classes. Default +false+
       #
+      # @param [Symbol] through Optional. When the resource is loaded through a parent relationship,
+      # the scope passed to the policy will be the parent's association. For example,
+      # +through: :user+ will pass +@user.posts+ as the scope to the PostPolicy.
+      #
       # @param [Constant] policy_class Optional. The policy class to use. Defaults from controller name.
       #
       # @param [Constant] policy_scope_class Optional. The policy scope class to use. Defaults from controller name.
@@ -90,12 +94,19 @@ module PunditCan
       instance_name = (options[:instance_name] || model_instance_name(options) || resource_class_name.underscore).to_s
       param_key = get_param_key(options, instance_name, model_class)
 
+      policy_kwopts = options.extract!(:policy_class)
+      policy_scope_kwopts = options.extract!(:policy_scope_class)
+
       loaded = if options[:parent]
-        load_parent_instance_var(model_class, param_key, options.extract!(:policy_class),
-          options.extract!(:policy_scope_class))
+        load_parent_instance_var(model_class, param_key, policy_kwopts, policy_scope_kwopts)
       else
-        load_instance_var(model_class, param_key, options.extract!(:policy_class),
-          options.extract!(:policy_scope_class))
+        # When :through is specified, pass the parent's association as the scope
+        scope_class = if options[:through] && (parent = instance_variable_get("@#{options[:through]}"))
+          parent.public_send(model_class.name.underscore.pluralize)
+        else
+          model_class
+        end
+        load_instance_var(model_class, param_key, policy_kwopts, policy_scope_kwopts, scope_class)
       end
 
       instance_name = instance_name.pluralize unless loaded.is_a?(model_class)
@@ -116,21 +127,21 @@ module PunditCan
       options[:model_class].name.underscore if options[:model_class].present? && options[:parent]
     end
 
-    def load_instance_var(model_class, param_key, policy_kwopts, policy_scope_kwopts)
+    def load_instance_var(model_class, param_key, policy_kwopts, policy_scope_kwopts, scope_class = model_class)
       case params[:action]
       when "index"
-        load_scope(model_class, policy_kwopts, policy_scope_kwopts)
+        load_scope(scope_class, policy_kwopts, policy_scope_kwopts)
       when "new"
         authorize(model_class.new, **policy_kwopts)
       when "create"
         authorize(model_class.new(permitted_attributes(model_class)), **policy_kwopts)
       when "edit", "update", "show", "destroy"
-        load_model(model_class, param_key, policy_kwopts, policy_scope_kwopts)
+        load_model(scope_class, param_key, policy_kwopts, policy_scope_kwopts)
       else
         if params[param_key]
-          load_model(model_class, param_key, policy_kwopts, policy_scope_kwopts)
+          load_model(scope_class, param_key, policy_kwopts, policy_scope_kwopts)
         else
-          load_scope(model_class, policy_kwopts, policy_scope_kwopts)
+          load_scope(scope_class, policy_kwopts, policy_scope_kwopts)
         end
       end
     end

data/lib/pundit_can/version.rb

@@ -1,3 +1,3 @@
 module PunditCan
-  VERSION = "0.1.2"
+  VERSION = "0.1.3"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: pundit_can
 version: !ruby/object:Gem::Version
-  version: 0.1.2
+  version: 0.1.3
 platform: ruby
 authors:
 - candland
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2023-12-25 00:00:00.000000000 Z
+date: 2026-03-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: pundit
@@ -89,7 +89,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.26
+rubygems_version: 3.5.22
 signing_key:
 specification_version: 4
 summary: Add cancan like load and authorize to controllers.