rbacan 0.3.2 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8927d4673bc1ccba40ab9d6380a1cfcc33c18b9b5117ad4e68d7bd00fb93d3e6
-  data.tar.gz: 1f8ae03be85e98f6bf340e2c7792bdb1f4312bb1f47d2b87d52a179fece4696d
+  metadata.gz: d73e61377cfc8c44c60d79857c8a5c09be75ddd8c7e6bd1547895dc11f03a673
+  data.tar.gz: 7027bf24c300f0996fd12cb94875bfb16ab24f0119b4442547da1ea054fb365b
 SHA512:
-  metadata.gz: 5f46b855672b6b46fae4702a163966762e08f18a19bbf562968e2a00a0e1dfef56558af2ea72d61de605b6676629d2aea893226db007fc7e40f5cd5d1b5b4f36
-  data.tar.gz: 91f15017848fc97fb1b16fa7355696281c8227dc53e7bb774c72d04cf40bdc53157c00f2390fde8e56ec07ad2ff4ca12835232eb0067ae2f96ca304c83f8f6dc
+  metadata.gz: 5363d5c569e9b65c754066baac8407b7d4047b9ecb11c5ba81ac66cec9f2fe2096837feb4e1ce3940cf53374fddeaa0feea034553917285e1871c0f6f968f2b7
+  data.tar.gz: ac1e65f2064108e82a9686b895b1ae1ea6f7badc9a49b3bcdc5e299f861413b9aaedc0bc3ad17605c0cbd10ea95ca5abf2872abaa23af9067bf7480dd0692a8a

data/CHANGELOG.md

@@ -2,6 +2,59 @@
 
 All notable changes to this project will be documented in this file.
 
+## [0.5.0] - 2026-09-12
+
+### Added
+
+- Host-owned authorization through immutable, value-based `Rbacan::AuthorizationContext` and pluggable authorization/assignment adapters.
+- Association-free `Rbacan::Authorizable` concern for applications that own their RBAC schema and lifecycle.
+- Explicit user and context resolvers for hardened route constraints.
+- Stable denial codes on `Rbacan::NotAuthorized` for host-side localization.
+- Configurable `role_key` and `permission_key` columns.
+- Deeply immutable JSON-like authorization metadata and copied immutable target codes.
+
+### Changed
+
+- Hardened mode is the default. Authorization requires an explicit context and fails closed without a host adapter.
+- Destructive/unscoped `Rbacan::Permittable`, catalog, role-permission, and seed-helper APIs require explicit `legacy_mode = true` opt-in.
+- Authorization contexts require a tenant and snapshot/freeze JSON-like tenant, property, vertical, and subject identifiers plus their timestamp.
+- Controller and view authorization use the host adapter in hardened mode.
+- Hardened redirect denials resolve their stable code through the host I18n backend.
+- Assignment dispatch rejects missing users or blank roles before invoking the host adapter.
+- Gem packaging uses an explicit runtime/documentation allowlist and excludes repository-only files.
+
+### Compatibility
+
+- Applications using the generated 0.4 schema must consciously enable legacy mode while migrating.
+
+## [0.4.0] - 2026-04-13
+
+### Added
+
+- `primary_key_type` config option — auto-detects host app's primary key type (supports `:uuid` and `:bigint`)
+- `tenant_scoped` config option — when `true`, adds `tenant_id` to `roles` and `user_roles` tables
+- `tenant_class` config option — configurable tenant model class name (default: `"Tenant"`)
+- `Rbacan.resolve_primary_key_type` — helper to resolve the effective PK type at runtime
+- Tenant-aware methods on `Permittable`:
+  - `roles_for_tenant(tenant_id)` — returns roles assigned in a specific tenant (+ global)
+  - `has_role_in_tenant?(role_name, tenant_id)` — checks role in tenant context
+  - `can_in_tenant?(permission_name, tenant_id)` — checks permission in tenant context
+- `assign_role` now accepts optional `tenant_id:` keyword argument for tenant-scoped assignments
+- `remove_role` now accepts optional `tenant_id:` keyword argument
+- `Role` scopes: `.global` (where tenant_id IS NULL), `.for_tenant(tenant_id)` (tenant + global roles)
+- `Role` model: conditional `belongs_to :tenant` when `tenant_scoped` is enabled
+- `UserRole` model: conditional `belongs_to :tenant` when `tenant_scoped` is enabled
+- Initializer template now documents all new configuration options
+- Migration templates now use explicit `type:` on `t.references` for FK columns
+
+### Fixed
+
+- `t.bigint :user_id` was hardcoded in `create_user_roles` migration — now uses `t.references :user` with proper type detection matching the host app's PK type
+- Migration templates now conditionally pass `id: :uuid` to `create_table` based on host app configuration
+- `create_role_permissions` migration now specifies explicit `type:` on foreign key references
+
+---
+
 ## [0.3.0] - 2026-03-31
 
 ### Added

data/README.md

@@ -38,6 +38,60 @@ bundle install
 
 ## Setup
 
+RBACan 0.5 has two explicit integration modes:
+
+- **Host-owned mode (recommended):** the application owns schema, tenancy, scopes, assignment history,
+  and record policies. Include `Rbacan::Authorizable` and configure adapters. Do not run the generator.
+- **Legacy generated-schema mode:** preserves the 0.4 Active Record API only after conscious
+  `config.legacy_mode = true` opt-in. Its removal methods delete join rows and are unsuitable for
+  immutable assignment-history requirements.
+
+### Host-owned mode
+
+```ruby
+class User < ApplicationRecord
+  include Rbacan::Authorizable
+end
+
+Rbacan.configure do |config|
+  config.role_class = 'Role'
+  config.role_key = :code
+  config.permission_class = 'Permission'
+  config.permission_key = :code
+  config.authorization_adapter = MyAuthorizationAdapter.new
+  config.assignment_adapter = MyAssignmentAdapter.new
+end
+```
+
+Every check receives an explicit immutable value context. Pass stable identifiers or JSON-like
+references, not live Active Record objects:
+
+```ruby
+context = Rbacan::AuthorizationContext.new(
+  tenant: current_tenant.id,
+  property: current_property.id,
+  vertical: current_property.property_type.to_s,
+  subject: { type: reservation.class.name, id: reservation.id },
+  at: Time.current
+)
+
+current_user.can?(:hotel_reservations_read, context: context)
+```
+
+The tenant identifier is required and cannot be nil, boolean, or empty. Tenant, property, vertical,
+subject, metadata, and timestamp values are copied
+and frozen when the context is created. Context identifiers must come from records already loaded
+through the host application's authenticated scope; the authorization adapter resolves and validates
+their relationships under the host's tenancy/RLS rules. The request's `user` remains the live host
+principal object.
+
+Adapters receive one request object. Authorization adapters respond to `allowed?(request)` or `call`;
+assignment adapters respond to `assign(request)` and `revoke(request)`. RBACan never prescribes deletion
+or caching in host-owned mode. Optional context metadata is deeply copied and frozen and accepts only
+hashes, arrays, strings, finite integers/floats, booleans, nil, and symbols.
+
+### Legacy generated-schema mode
+
 **1. Run the generator**
 
 ```bash
@@ -72,13 +126,21 @@ rails db:seed
 
 ## Configuration
 
-The generator creates `config/initializers/rbacan.rb`. All options are optional — the defaults work for a standard Devise setup.
+The generator creates `config/initializers/rbacan.rb`. Generated-schema applications must explicitly
+enable legacy mode; the remaining defaults then work for a standard Devise setup.
 
 ```ruby
 Rbacan.configure do |config|
+  # Conscious opt-in required for the destructive/unscoped 0.4 API while migrating.
+  config.legacy_mode = true
+
   # Your user model name (default: "User")
   config.permittable_class = "User"
 
+  # Host key columns default to :name.
+  # config.role_key = :code
+  # config.permission_key = :code
+
   # Override model class names if you have custom implementations
   # config.role_class             = "Rbacan::Role"
   # config.permission_class       = "Rbacan::Permission"
@@ -107,7 +169,7 @@ end
 
 ## Defining Roles and Permissions
 
-Use the `Rbacan::RolesAndPermissions` module in your seeds. All methods are idempotent — safe to run multiple times.
+In legacy mode, use the `Rbacan::RolesAndPermissions` module in your seeds. All methods are idempotent — safe to run multiple times. Hardened mode rejects these unscoped helpers; host-owned applications must seed their own scoped authorization records.
 
 ```ruby
 # db/seeds.rb
@@ -201,9 +263,20 @@ Include `Rbacan::Authorization` in your `ApplicationController` (or any specific
 ```ruby
 class ApplicationController < ActionController::Base
   include Rbacan::Authorization
+  helper_method :rbacan_authorization_context
+
+  private
+
+  def rbacan_authorization_context
+    AuthorizationContextResolver.call(request: request, user: current_user, subject: @post)
+  end
 end
 ```
 
+The host resolver must build the immutable identifier context only after authenticating the user and
+loading tenant, property, and optional subject records through the authorized scope.
+`AuthorizationContextResolver` is application-defined; RBACan does not infer these values.
+
 Then use `authorize!` or `authorize_role!` as `before_action` callbacks:
 
 ```ruby
@@ -255,7 +328,9 @@ config.unauthorized_handler = ->(controller, permission:, role:) {
 
 ## View Helpers
 
-`Rbacan::ViewHelpers` is automatically included in all views. Use `authorized?` to conditionally render content:
+`Rbacan::ViewHelpers` is automatically included in all views. In host-owned mode the host must expose
+`current_user` and `rbacan_authorization_context` to the view. Use `authorized?` to conditionally
+render content:
 
 ```erb
 <% authorized?(:delete_post) do %>
@@ -267,40 +342,47 @@ config.unauthorized_handler = ->(controller, permission:, role:) {
 <% end %>
 ```
 
-You can also use `has_role?` and `has_any_role?` directly in views since they are instance methods on the user:
+You can also use `has_role?` directly in views through the host-owned concern:
 
 ```erb
-<% if current_user.has_role?(:admin) %>
+<% if current_user.has_role?(:admin, context: rbacan_authorization_context) %>
   <%= link_to "Admin Panel", admin_root_path %>
 <% end %>
-
-<% if current_user.has_any_role?(:admin, :moderator) %>
-  <%= link_to "Moderation Queue", moderation_path %>
-<% end %>
 ```
 
 ---
 
 ## Route Constraints
 
-Restrict access to entire route namespaces based on role or permission. Add constraints in `config/routes.rb`:
+Restrict access to entire route namespaces based on role or permission. Hardened mode requires explicit
+request resolvers:
 
 ```ruby
-# Restrict by role
-constraints Rbacan::RouteConstraint.new(role: :admin) do
+resolve_user = ->(request) { CurrentSessionResolver.call(request) }
+resolve_context = ->(request) { AuthorizationContextResolver.call(request) }
+
+constraints Rbacan::RouteConstraint.new(
+  role: :admin,
+  user_resolver: resolve_user,
+  context_resolver: resolve_context
+) do
   namespace :admin do
     resources :users
     resources :roles
   end
 end
 
-# Restrict by permission
-constraints Rbacan::RouteConstraint.new(permission: :access_dashboard) do
+constraints Rbacan::RouteConstraint.new(
+  permission: :access_dashboard,
+  user_resolver: resolve_user,
+  context_resolver: resolve_context
+) do
   get "/dashboard", to: "dashboard#index"
 end
 ```
 
-The constraint reads the current user from the Warden session (used by Devise). For apps using a manual session, it falls back to looking up `session[:user_id]`.
+Without both resolvers hardened constraints fail closed. In explicitly enabled legacy mode only, the
+constraint retains the 0.4 behavior of reading Warden or `session[:user_id]`.
 
 ---
 

data/app/models/rbacan/role.rb

@@ -1,13 +1,26 @@
 module Rbacan
-    class Role < ApplicationRecord
-        self.table_name = Rbacan.role_table
+  class Role < ApplicationRecord
+    self.table_name = Rbacan.role_table
 
-        validates :name, presence: true, uniqueness: true
-        
-        has_many :role_permissions, class_name: Rbacan.role_permission_class, dependent: :destroy
-        has_many :permissions, class_name: Rbacan.permission_class, through: :role_permissions
+    validates :name, presence: true
+    validates :name, uniqueness: true, unless: -> { Rbacan.tenant_scoped && tenant_id.present? }
+    validates :name, uniqueness: { scope: :tenant_id }, if: -> { Rbacan.tenant_scoped && tenant_id.present? }
 
-        has_many :user_roles, class_name: Rbacan.user_role_class, dependent: :destroy
-        has_many :users, class_name: Rbacan.permittable_class, through: :user_roles
-    end
+    has_many :role_permissions, class_name: Rbacan.role_permission_class, dependent: :destroy
+    has_many :permissions, class_name: Rbacan.permission_class, through: :role_permissions
+
+    has_many :user_roles, class_name: Rbacan.user_role_class, dependent: :destroy
+    has_many :users, class_name: Rbacan.permittable_class, through: :user_roles
+
+    # Tenant association — only meaningful when tenant_scoped is enabled.
+    # The column must exist in the database; it is added by the migration
+    # when tenant_scoped is true.
+    belongs_to :tenant, class_name: Rbacan.tenant_class, optional: true if Rbacan.tenant_scoped
+
+    # Global roles have no tenant (tenant_id IS NULL).
+    scope :global, -> { where(tenant_id: nil) }
+
+    # Returns roles available for a specific tenant: its own roles plus global roles.
+    scope :for_tenant, ->(tenant_id) { where(tenant_id: [tenant_id, nil]) }
+  end
 end

data/app/models/rbacan/user_role.rb

@@ -1,8 +1,11 @@
 module Rbacan
-    class UserRole < ApplicationRecord
-        self.table_name = Rbacan.user_role_table
+  class UserRole < ApplicationRecord
+    self.table_name = Rbacan.user_role_table
 
-        belongs_to :role, class_name: Rbacan.role_class
-        belongs_to :user, class_name: Rbacan.permittable_class
-    end
+    belongs_to :role, class_name: Rbacan.role_class
+    belongs_to :user, class_name: Rbacan.permittable_class
+
+    # Tenant association — only meaningful when tenant_scoped is enabled.
+    belongs_to :tenant, class_name: Rbacan.tenant_class, optional: true if Rbacan.tenant_scoped
+  end
 end

data/lib/generators/install/templates/create_permissions.rb

@@ -1,6 +1,6 @@
 class CreatePermissions < ActiveRecord::Migration[<%= ActiveRecord::Migration.current_version %>]
   def change
-    create_table :permissions do |t|
+    create_table :permissions<%= ", id: :uuid" if primary_key_type == :uuid %> do |t|
       t.string :name, null: false
 
       t.timestamps

data/lib/generators/install/templates/create_role_permissions.rb

@@ -1,8 +1,8 @@
 class CreateRolePermissions < ActiveRecord::Migration[<%= ActiveRecord::Migration.current_version %>]
   def change
-    create_table :role_permissions do |t|
-      t.references :role,       null: false, index: true, foreign_key: { to_table: :roles,       on_delete: :cascade }
-      t.references :permission, null: false, index: true, foreign_key: { to_table: :permissions, on_delete: :cascade }
+    create_table :role_permissions<%= ", id: :uuid" if primary_key_type == :uuid %> do |t|
+      t.references :role,       null: false, type: :<%= primary_key_type %>, index: true, foreign_key: { to_table: :roles,       on_delete: :cascade }
+      t.references :permission, null: false, type: :<%= primary_key_type %>, index: true, foreign_key: { to_table: :permissions, on_delete: :cascade }
 
       t.timestamps
     end

data/lib/generators/install/templates/create_roles.rb

@@ -1,11 +1,20 @@
 class CreateRoles < ActiveRecord::Migration[<%= ActiveRecord::Migration.current_version %>]
   def change
-    create_table :roles do |t|
+    create_table :roles<%= ", id: :uuid" if primary_key_type == :uuid %> do |t|
       t.string :name, null: false
+<% if tenant_scoped? %>
+      t.references :tenant, null: true, type: :<%= primary_key_type %>, index: true
+<% end %>
 
       t.timestamps
     end
+<% if tenant_scoped? %>
+
+    add_index :roles, :name, unique: true, where: "tenant_id IS NULL", name: "index_roles_on_name_global"
+    add_index :roles, [:tenant_id, :name], unique: true, name: "index_roles_on_tenant_id_and_name"
+<% else %>
 
     add_index :roles, :name, unique: true
+<% end %>
   end
 end

data/lib/generators/install/templates/create_user_roles.rb

@@ -1,13 +1,20 @@
 class CreateUserRoles < ActiveRecord::Migration[<%= ActiveRecord::Migration.current_version %>]
   def change
-    create_table :user_roles do |t|
-      t.references :role, null: false, index: true, foreign_key: { to_table: :roles, on_delete: :cascade }
-      t.bigint :user_id,  null: false
+    create_table :user_roles<%= ", id: :uuid" if primary_key_type == :uuid %> do |t|
+      t.references :role, null: false, type: :<%= primary_key_type %>, index: true, foreign_key: { to_table: :roles, on_delete: :cascade }
+      t.references :user, null: false, type: :<%= primary_key_type %>, index: true
+<% if tenant_scoped? %>
+      t.references :tenant, null: true, type: :<%= primary_key_type %>, index: true
+<% end %>
 
       t.timestamps
     end
+<% if tenant_scoped? %>
+
+    add_index :user_roles, [:user_id, :role_id, :tenant_id], unique: true, name: "index_user_roles_unique"
+<% else %>
 
-    add_index :user_roles, :user_id
     add_index :user_roles, [:user_id, :role_id], unique: true
+<% end %>
   end
 end

data/lib/generators/install/templates/rbacan.rb

@@ -1,30 +1,45 @@
 Rbacan.configure do |config|
-  # The name of your user model (default: "User")
+  # Hardened host-owned mode is the default. The generated 0.4-style schema remains
+  # inactive until the host consciously opts into its destructive/unscoped APIs:
+  # config.legacy_mode = true
+
+  # Name of your user model (default: "User")
   # config.permittable_class = "User"
 
-  # Override AR model class names if you have custom models
-  # config.role_class             = "Rbacan::Role"
-  # config.permission_class       = "Rbacan::Permission"
-  # config.user_role_class        = "Rbacan::UserRole"
-  # config.role_permission_class  = "Rbacan::RolePermission"
+  # Override ActiveRecord model class names if you use custom models
+  # config.role_class = "Rbacan::Role"
+  # config.permission_class = "Rbacan::Permission"
+  # config.user_role_class = "Rbacan::UserRole"
+  # config.role_permission_class = "Rbacan::RolePermission"
+
+  # Host role/permission lookup columns (default: :name)
+  # config.role_key = :code
+  # config.permission_key = :code
 
   # Override table names if needed
-  # config.role_table             = "roles"
-  # config.permission_table       = "permissions"
-  # config.user_role_table        = "user_roles"
-  # config.role_permission_table  = "role_permissions"
+  # config.role_table = "roles"
+  # config.permission_table = "permissions"
+  # config.user_role_table = "user_roles"
+  # config.role_permission_table = "role_permissions"
+
+  # Primary key type for migrations.
+  # Set :uuid if your app uses UUID primary keys.
+  # When nil, auto-detects Rails generator config (primary_key_type).
+  # config.primary_key_type = :uuid
+
+  # Enable tenant scoping for roles and user_roles.
+  # When true, adds tenant_id to roles and user_roles.
+  # Permissions remain global regardless of this setting.
+  # config.tenant_scoped = false
+
+  # Name of your tenant model class (default: "Tenant").
+  # Only used when tenant_scoped is true.
+  # config.tenant_class = "Tenant"
 
   # Authorization failure handling:
   #   :raise    — raises Rbacan::NotAuthorized (default)
   #   :redirect — redirects to unauthorized_redirect_path
   #   lambda    — called with (controller, permission:, role:)
-  #
   # config.unauthorized_handler = :raise
-  # config.unauthorized_handler = :redirect
-  # config.unauthorized_handler = ->(controller, permission:, role:) {
-  #   controller.render plain: "Forbidden", status: :forbidden
-  # }
-
-  # Path to redirect to when unauthorized_handler is :redirect
   # config.unauthorized_redirect_path = "/"
 end

data/lib/generators/rbacan/install_generator.rb

@@ -5,8 +5,8 @@ module Rbacan
   module Generators
     class InstallGenerator < ::Rails::Generators::Base
       include Rails::Generators::Migration
-      source_root File.expand_path('../../install/templates', __FILE__)
-      desc "Add the migrations for roles and permissions"
+      source_root File.expand_path('../install/templates', __dir__)
+      desc 'Add the migrations for roles and permissions'
 
       def self.next_migration_number(path)
         next_migration_number = current_migration_number(path) + 1
@@ -14,19 +14,38 @@ module Rbacan
       end
 
       def copy_migrations
-        migration_template "create_permissions.rb", "db/migrate/create_permissions.rb"
-        migration_template "create_roles.rb", "db/migrate/create_roles.rb"
-        migration_template "create_role_permissions.rb", "db/migrate/create_role_permissions.rb"
-        migration_template "create_user_roles.rb", "db/migrate/create_user_roles.rb"
+        migration_template 'create_permissions.rb', 'db/migrate/create_permissions.rb'
+        migration_template 'create_roles.rb', 'db/migrate/create_roles.rb'
+        migration_template 'create_role_permissions.rb', 'db/migrate/create_role_permissions.rb'
+        migration_template 'create_user_roles.rb', 'db/migrate/create_user_roles.rb'
       end
 
       def copy_seed
-        copy_file 'copy_to_seeds.rb', "db/copy_to_seeds.rb"
+        copy_file 'copy_to_seeds.rb', 'db/copy_to_seeds.rb'
       end
 
       def copy_initializer
         copy_file 'rbacan.rb', 'config/initializers/rbacan.rb'
       end
+
+      private
+
+      # Resolves the primary key type for migration templates.
+      # Checks the explicit Rbacan config first, then the Rails generator config.
+      def primary_key_type
+        configured = Rbacan.primary_key_type
+        configured ||= begin
+          Rails.configuration.generators.options.dig(:active_record, :primary_key_type)
+        rescue StandardError
+          nil
+        end
+        configured || :bigint
+      end
+
+      # Whether tenant scoping is enabled.
+      def tenant_scoped?
+        Rbacan.tenant_scoped
+      end
     end
   end
 end

data/lib/rbacan/authorizable.rb

@@ -0,0 +1,15 @@
+require 'active_support/concern'
+
+module Rbacan
+  module Authorizable
+    extend ActiveSupport::Concern
+
+    def can?(permission, context:)
+      Rbacan.authorized?(user: self, permission: permission, context: context)
+    end
+
+    def has_role?(role, context:)
+      Rbacan.authorized?(user: self, role: role, context: context)
+    end
+  end
+end

data/lib/rbacan/authorization.rb

@@ -1,29 +1,51 @@
 require 'active_support/concern'
+require 'i18n'
 
 module Rbacan
   module Authorization
     extend ActiveSupport::Concern
 
-    included do
-      helper_method :authorized? if respond_to?(:helper_method)
-    end
-
     # Calls the unauthorized handler if current_user lacks the given permission.
-    def authorize!(permission)
-      unless current_user&.can?(permission.to_s)
+    def authorize!(permission, context: nil)
+      allowed = if Rbacan.legacy_mode
+                  current_user&.can?(permission.to_s)
+                else
+                  Rbacan.authorized?(
+                    user: current_user,
+                    permission: permission,
+                    context: context || rbacan_authorization_context
+                  )
+                end
+
+      unless allowed
         _handle_unauthorized(permission: permission.to_s)
       end
     end
 
     # Calls the unauthorized handler if current_user lacks the given role.
-    def authorize_role!(role)
-      unless current_user&.has_role?(role.to_s)
+    def authorize_role!(role, context: nil)
+      allowed = if Rbacan.legacy_mode
+                  current_user&.has_role?(role.to_s)
+                else
+                  Rbacan.authorized?(
+                    user: current_user,
+                    role: role,
+                    context: context || rbacan_authorization_context
+                  )
+                end
+
+      unless allowed
         _handle_unauthorized(role: role.to_s)
       end
     end
 
     private
 
+    def rbacan_authorization_context
+      raise Rbacan::ConfigurationError,
+            'authorization context is required; define rbacan_authorization_context in the host controller'
+    end
+
     def _handle_unauthorized(permission: nil, role: nil)
       handler = Rbacan.unauthorized_handler
 
@@ -31,8 +53,14 @@ module Rbacan
       when :raise
         raise Rbacan::NotAuthorized.new(nil, permission: permission, role: role)
       when :redirect
+        error = Rbacan::NotAuthorized.new(nil, permission: permission, role: role)
+        alert = if Rbacan.legacy_mode
+                  error.message
+                else
+                  I18n.t(error.code, permission: permission, role: role, raise: true)
+                end
         redirect_to Rbacan.unauthorized_redirect_path,
-                    alert: Rbacan::NotAuthorized.new(nil, permission: permission, role: role).message
+                    alert: alert
       else
         if handler.respond_to?(:call)
           handler.call(self, permission: permission, role: role)