pundit_can 0.1.3 → 0.1.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 68cee5b5723a2c0b9640e59280996fc46df7d91b3def9b26a586e13350e94788
-  data.tar.gz: 543cb75c45f2ff523c80a1339a9e474a61b65610206fa68ff5c4da5a365d2268
+  metadata.gz: 95df5ff56989946351acaa622d23e1aa0d0575e8cce7c47dd4e47b266a02c247
+  data.tar.gz: e9f75be20b4e055f0583657ef05d3dcea4cdb314f6998642bef734c369fd8024
 SHA512:
-  metadata.gz: ac50a363d20811f5853520cebb4ab6e16cb1d0b59c91e8d81df311df97fafb36e72116c27343e723210f6024254c257ba6082744eeaa4df00f18ce893bd4a7fd
-  data.tar.gz: d6898b262559d7cd73215b8227de81e387d73257525bcde96611847c821223f54a173fcd0c016dfe4dedfdae8d503afc1b148b387c7dd13a5475e7db8244969f
+  metadata.gz: 1ff5fb33b343efd582132d77edeb12651b73dd40f0c035c301997beb6f775cdd3a9dbfb660f16897f0a0f34655beeddab96d32f48732497229dd03900cdeafc6
+  data.tar.gz: 365fbe976dea92ef37d57701f363f6f416a078983e46bd9a6002cdb9283a1341df0ca5c163c7b5de95f2861b483a2e17cc086ba1518d5a6d365ac523cdbdccbd

data/README.md

@@ -44,6 +44,35 @@ And it will load `@post` or `@posts` using the `PostPolicy` with the `:id` param
 If there is no parent instance variable set (e.g., a non-nested route), it will fall back
 to the default behavior of scoping with the model class.
 
+When the association name doesn't match the model name, use the `:association` option:
+```ruby
+class ArticlesController < ApplicationController
+  load_resource model_class: User, parent: true
+  load_resource model_class: Article, through: :user, association: :articles
+
+  # This passes @user.articles instead of @user.posts to the ArticlePolicy::Scope
+end
+```
+
+This is useful when you have associations like `has_many :published_posts, class_name: "Post"`
+or other cases where the association method name differs from the model class name.
+
+When the parent relationship attribute in the model uses a different name than the `:through`
+option, use the `:parent_key` option:
+
+```ruby
+class ArticlesController < ApplicationController
+  load_resource model_class: User, parent: true
+  load_resource model_class: Article, through: :user, parent_key: :admin
+
+  # This builds Article.new(admin: @user) instead of Article.new(user: @user)
+end
+```
+
+This is useful when the model's foreign key or association attribute name differs from the
+parent's instance name. For example, when `belongs_to :admin, class_name: "User"` or
+`belongs_to :author, class_name: "User"` is used instead of a standard `belongs_to :user`.
+
 #### Customized loading
 
 You can customize the loading for cases when the model, controller, and policies don't match up name-wise.

data/lib/pundit_can/load_and_authorize.rb

@@ -72,6 +72,18 @@ module PunditCan
       # the scope passed to the policy will be the parent's association. For example,
       # +through: :user+ will pass +@user.posts+ as the scope to the PostPolicy.
       #
+      # @param [Symbol] association Optional. When used with +:through+, specifies the association
+      # method name to call on the parent. By default, the association name is derived from the
+      # model class name (e.g., +Post+ becomes +posts+). Use this option when the association name
+      # differs from the model name. For example, +through: :user, association: :articles+ will
+      # pass +@user.articles+ as the scope.
+      #
+      # @param [Symbol] parent_key Optional. When used with +:through+, specifies the associated
+      # method on the model and sets the parent. By default the parent_key value = +:through+. Use
+      # this when the parent relationship in the model uses a different name.
+      # For example, +through: :user, parent_key: :admin+ will
+      # pass +Article.new(admin: @user)+ when creating new model instances.
+      #
       # @param [Constant] policy_class Optional. The policy class to use. Defaults from controller name.
       #
       # @param [Constant] policy_scope_class Optional. The policy scope class to use. Defaults from controller name.
@@ -97,16 +109,19 @@ module PunditCan
       policy_kwopts = options.extract!(:policy_class)
       policy_scope_kwopts = options.extract!(:policy_scope_class)
 
+      parent = instance_variable_get("@#{options[:through]}") if options[:through]
+
       loaded = if options[:parent]
         load_parent_instance_var(model_class, param_key, policy_kwopts, policy_scope_kwopts)
       else
         # When :through is specified, pass the parent's association as the scope
-        scope_class = if options[:through] && (parent = instance_variable_get("@#{options[:through]}"))
-          parent.public_send(model_class.name.underscore.pluralize)
+        scope_class = if parent
+          assoc = options[:association] || model_class.name.underscore.pluralize
+          parent.public_send(assoc)
         else
           model_class
         end
-        load_instance_var(model_class, param_key, policy_kwopts, policy_scope_kwopts, scope_class)
+        load_instance_var(model_class, param_key, policy_kwopts, policy_scope_kwopts, scope_class, parent, options[:through] || options[:parent_key])
       end
 
       instance_name = instance_name.pluralize unless loaded.is_a?(model_class)
@@ -127,14 +142,18 @@ module PunditCan
       options[:model_class].name.underscore if options[:model_class].present? && options[:parent]
     end
 
-    def load_instance_var(model_class, param_key, policy_kwopts, policy_scope_kwopts, scope_class = model_class)
+    def load_instance_var(model_class, param_key, policy_kwopts, policy_scope_kwopts, scope_class = model_class, parent = nil, parent_key = nil)
       case params[:action]
       when "index"
         load_scope(scope_class, policy_kwopts, policy_scope_kwopts)
-      when "new"
-        authorize(model_class.new, **policy_kwopts)
-      when "create"
-        authorize(model_class.new(permitted_attributes(model_class)), **policy_kwopts)
+      when "create", "new"
+        parent_attributes = {}
+        parent_attributes[parent_key] = parent if parent
+        if params[:action] == "new"
+          authorize(model_class.new(parent_attributes), **policy_kwopts)
+        else
+          authorize(model_class.new(parent_attributes.merge(permitted_attributes(model_class))), **policy_kwopts)
+        end
       when "edit", "update", "show", "destroy"
         load_model(scope_class, param_key, policy_kwopts, policy_scope_kwopts)
       else

data/lib/pundit_can/version.rb

@@ -1,3 +1,3 @@
 module PunditCan
-  VERSION = "0.1.3"
+  VERSION = "0.1.5"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: pundit_can
 version: !ruby/object:Gem::Version
-  version: 0.1.3
+  version: 0.1.5
 platform: ruby
 authors:
 - candland
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-03-18 00:00:00.000000000 Z
+date: 2026-05-18 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: pundit