rubocop-dev_doc 0.10.4 → 0.11.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: b11d7c80b04d4ef7ecbff606f3920260773ae1767ffcacab78e99663920ca9d7
-  data.tar.gz: eaae1ebc845ca76bc72a878916d1f096c5495ce16b9238734c823875b0ba2323
+  metadata.gz: 83da1f7ff50b778721408a7f3713a0708a4749bf0af5e5df9e96810aa7f2be1c
+  data.tar.gz: 6b69c63a8bd53bd6a012acaa46ae7134581dbf2760f5e7627948dcd8b137558f
 SHA512:
-  metadata.gz: 0c227078e2a29302744d3b14cd3058f5912b50831221b82d7ab8cb13885ffaf4bca0eb7e8784745bd470533190e6c522d3f69b28f7e64cc18f183d2a39d6dd19
-  data.tar.gz: b7f474e88689ce7bd672e735458b5b8e45c5c47448b44461b673a46b8ac4b74c997ccebf548b02b33460095214c2d6920211ffb621a82eca3e231d8f65898f4d
+  metadata.gz: 8b79ae456b8c5518023e9b89ba0232dfeb9fc64cb9a53d2e3e0ac18854a2d8b6f96b02e5a2ff3fd0928c19a32e9f5ae5204e3a5c3aa24af566dea1d8c7b24186
+  data.tar.gz: 7ffae58fc78c00ca6abdfab21e3c4517528183c3130e765b2aac198a44b91c2e8b2c9969fc9c3e7bd7c42243d78406f659ea4be94575df28fde2753bb4f22dfa

data/config/default.yml

@@ -640,15 +640,60 @@ DevDoc/Auth/LoadResourceCurrentUserGuard:
   CurrentUserAssertionMethodNames:
     - assert_current_user_present
 
+# AllowedMethods classifies the FIRST method called on current_user (or a
+# same-file alias — `@user = current_user` is taint-tracked) in a condition:
+# listed = data read, passes; unlisted = role predicate or unclassified,
+# flags. A closed set on purpose — each addition is a reviewed "data or
+# permission?" decision. The universally-generic baseline (errors, id, email,
+# persisted?, new_record?) is built into the cop
+# (DEFAULT_ALLOWED_METHODS) and CANNOT be dropped by configuration — the
+# list below is purely ADDITIVE, so projects never repeat the baseline (a
+# project AllowedMethods would otherwise REPLACE it: RuboCop does not merge
+# array config). Add your app's own data reads (MFA flags, verification
+# progress, ...) in .rubocop.yml.
 DevDoc/Auth/CurrentUserBranching:
   Description: "Avoid branching on `current_user` / `user_signed_in?` in page-specific code. Use shared layouts or an inline disable with a reason for genuinely dual-state pages."
   Enabled: true
+  AllowedMethods: []
   Exclude:
     - "app/policies/**/*.rb"
     - "app/helpers/**/*.rb"
     - "app/controllers/concerns/**/*.rb"
     - "app/views/layouts/**/*"
 
+# The receiver-agnostic companion to CurrentUserBranching: taint can't follow
+# an ivar from controller to view, and wrapper methods break the chain — but
+# the role-predicate NAME is visible on any receiver (`@user.admin?`,
+# `viewer.admin?`). Populate RolePredicates with every role predicate your
+# User/Member models define.
+#
+# The two cops COMPOSE as a pair of nets: CurrentUserBranching is default-deny
+# at the auth root (a brand-new role predicate called on current_user flags as
+# unclassified with zero config), while this cop makes the KNOWN predicates
+# undodgeable on any receiver. The escape requires a new name AND a laundered
+# receiver simultaneously — and each name triaged into RolePredicates closes
+# that hole permanently (the ratchet). RATCHET, step two: once page code
+# queries policies by purpose (`policy(x).auto_approve?`), add any generic
+# role getters your policies export (`user_is_admin?`, `user_is_super_admin?`)
+# to RolePredicates too — policies are excluded paths, so policy-internal use
+# stays free while new loose call sites in page code are blocked mechanically.
+DevDoc/Auth/RolePredicateOutsidePolicy:
+  Description: "Role predicates (`admin?`, ...) answer authorization questions and belong in Pundit policies; query via `policy(record).x?` instead of calling them in page code."
+  Enabled: true
+  RolePredicates:
+    - admin?
+    - super_admin?
+  Exclude:
+    - "app/policies/**/*.rb"
+    - "app/models/**/*.rb"
+    - "app/helpers/**/*.rb"
+    - "app/views/layouts/**/*"
+    # Tests assert role facts as fixture preconditions (`assert_not
+    # stranger.effective_admin_of_organization?(org)`) — they verify the
+    # permission model rather than fragment it.
+    - "test/**/*"
+    - "spec/**/*"
+
 DevDoc/I18n/AvoidTitleizeHumanize:
   Description: "Avoid `.titleize`/`.humanize` for display text; it's English-only and bypasses I18n. Use `t(...)`."
   # A review aid, not a clean lint: it can't tell a display string from one

data/lib/rubocop/cop/dev_doc/auth/current_user_branching.rb

@@ -1,3 +1,5 @@
+require_relative "current_user_branching_helpers"
+
 module RuboCop
   module Cop
     module DevDoc
@@ -43,16 +45,63 @@ module RuboCop
         # ## Patterns flagged
         # - `if current_user` / `unless current_user` (block or modifier) where
         #   the body is non-empty and is not a bare `return` (bare returns are
-        #   the nil-guard pattern covered by LoadResourceCurrentUserGuard).
+        #   the nil-guard pattern covered by LoadResourceCurrentUserGuard; the
+        #   exemption covers every nil-test spelling of the guard —
+        #   `return if current_user.nil?`, `return unless
+        #   current_user.present?`, `return if !current_user`).
         # - `if user_signed_in?` / `unless user_signed_in?` (any form).
-        # - `if current_user&.foo` and other safe-nav uses of `current_user`
-        #   as a condition. The `&.` is itself a confession that the dev
-        #   expects `current_user` to be nil sometimes — i.e., it's the same
-        #   anti-pattern as `if current_user`, just in disguise: when
-        #   `current_user` is nil the csend returns nil → branch is dead for
-        #   anonymous visitors, exactly what the cop prevents.
+        # - The evasion spellings — all equivalent to the bare form and all
+        #   measured in the wild once the bare form was policed:
+        #   `current_user.present?` / `.blank?` / `.nil?`, `!current_user`,
+        #   `!user_signed_in?`, and boolean combinations
+        #   (`current_user && x`, `user_signed_in? || y`).
+        # - ANY method chain rooted at `current_user` used as a condition —
+        #   both `current_user&.admin?` and plain `current_user.admin?`. The
+        #   `&.` is a confession that the dev expects nil; the plain chain is
+        #   a role/ownership check that belongs in the policy (see below).
         # - Ternaries: `current_user ? a : b`, `user_signed_in? ? a : b`.
         # - Hash/argument values: `authenticated: user_signed_in?`.
+        # - ALIASES: a local/instance variable assigned from `current_user`
+        #   in the same file inherits every rule above — `@user =
+        #   current_user` followed by `if @user.admin?` is the same branch
+        #   laundered, and it flags identically. Only PURE aliases are
+        #   tracked: every assignment to the name must be an unconditional
+        #   `= current_user` (case dispatch counts as unconditional). A
+        #   conditional assignment or a second source makes the variable a
+        #   genuinely nilable/general resource holder — branching on it is
+        #   resource-presence logic, not auth state. Taint is per-file only:
+        #   an ivar assigned in the controller and read in a view is not
+        #   tracked — pair this cop with the receiver-agnostic
+        #   `DevDoc/Auth/RolePredicateOutsidePolicy`, which closes that gap
+        #   for the known role predicates.
+        #
+        # ## AllowedMethods — classifying data reads
+        # The first method called on `current_user` (or a tainted alias) in a
+        # condition is CLASSIFIED: entries in `AllowedMethods` are data reads
+        # (`current_user.errors.any?`, an MFA-configured flag) and pass;
+        # everything else — role predicates and methods nobody has classified
+        # yet — flags. The list is a closed set on purpose: every new reader
+        # used in a condition forces a reviewed "data or permission?" decision
+        # in `.rubocop.yml` rather than slipping through. The
+        # universally-generic baseline (errors, id, email, persisted?,
+        # new_record? — `DEFAULT_ALLOWED_METHODS`) is built into the cop and
+        # cannot be un-configured; the yml list is purely ADDITIVE, so
+        # projects list only their own readers:
+        #
+        #   DevDoc/Auth/CurrentUserBranching:
+        #     AllowedMethods:
+        #       - otp_required_for_login
+        #
+        # ## Moving a decision to the policy — query by PURPOSE
+        # The policy move is only complete when the policy owns the
+        # role->behavior rule, not just the role's spelling. Export a
+        # decision-shaped query (`auto_approve?`, `initiation_blocked_for_admin?`,
+        # or an `authorize` block) and call THAT from page code. A generic role
+        # getter (`def user_is_admin? = current_user&.admin?`) re-opens the
+        # scattering: every call site invents its own rule again, one policy
+        # door down. If your policies must expose such getters as internal
+        # building blocks, list their names in the companion cop's
+        # RolePredicates so page code cannot call them.
         #
         # ## Allowed paths (Exclude:)
         # By default the cop is silent in:
@@ -139,9 +188,21 @@ module RuboCop
         #     ...
         #   end
         class CurrentUserBranching < Base
-          MSG = 'Avoid branching on auth state in page code. ' \
-                'If this page serves both anonymous and signed-in users, ' \
-                'add an inline disable with a reason.'.freeze
+          include CurrentUserBranchingHelpers
+
+          MSG = 'Branching on auth state in page code — decide what this branch really is: ' \
+                'auth is required here -> the anonymous branch is dead code, delete it; ' \
+                'a role/ownership check -> move the DECISION into the Pundit policy and ' \
+                'query it by purpose (`policy(record).auto_approve?`, `can?(:update, x)`) ' \
+                '— do NOT export a generic role getter (`user_is_admin?`) from the policy: ' \
+                'that centralizes only the spelling while every call site keeps its own ' \
+                'role->behavior rule; a plain data read (not permission-related) -> ' \
+                'classify the method in AllowedMethods; genuinely dual-state -> move the ' \
+                'branching to a layout/helper (excluded paths — PRESENTATION branching ' \
+                'only, keyed on entity-scoped facts, never smuggled permission logic) or ' \
+                'split anonymous/signed-in partials. Aliasing (`user = current_user`) ' \
+                'does not exempt any of this. Only a small, local branch on a genuinely ' \
+                'dual-state PAGE warrants an inline disable with a reason.'.freeze
 
           AUTH_METHODS = %i[current_user user_signed_in?].freeze
 
@@ -152,9 +213,17 @@ module RuboCop
             add_offense(if_offense_location(node))
           end
 
-          # `value: user_signed_in?` — condition passed as a value.
+          # `value: user_signed_in?` — the BOOLEAN auth state passed as data,
+          # which smuggles the branch to the consumer/client. Deliberately
+          # limited to `user_signed_in?`: bare `current_user` passed as data
+          # (`requested_by: current_user`, `model: current_user`,
+          # `x.user == current_user`) is actorship recording or identity
+          # comparison, not branching — flagging it measured 44 noise
+          # offenses / 0 finds on a mature codebase.
+          VALUE_FLAGGED_METHODS = %i[user_signed_in?].freeze
+
           def on_send(node)
-            return unless auth_method_call?(node)
+            return unless VALUE_FLAGGED_METHODS.include?(node.method_name) && node.receiver.nil?
             return unless used_as_value?(node)
 
             add_offense(node.loc.selector)
@@ -166,46 +235,6 @@ module RuboCop
             node.if_type? && auth_condition?(node.condition)
           end
 
-          def auth_condition?(condition)
-            return false unless condition
-
-            if condition.send_type?
-              AUTH_METHODS.include?(condition.method_name) && condition.receiver.nil?
-            elsif condition.csend_type?
-              # `current_user&.foo` — the safe-nav is itself the auth check;
-              # `bare_current_user_condition?` won't match (it requires send),
-              # so guard-return forms like `return unless current_user&.admin?`
-              # correctly stay flagged.
-              receiver = condition.receiver
-              receiver&.send_type? &&
-                receiver.method_name == :current_user &&
-                receiver.receiver.nil?
-            else
-              false
-            end
-          end
-
-          # `return unless current_user` (and similar bare guards) should not
-          # be flagged — they are the correct pattern handled by
-          # LoadResourceCurrentUserGuard. Detect: an if whose condition is bare
-          # `current_user` and one branch is a bare `return` (no arguments).
-          def bare_return_guard?(node)
-            condition = node.condition
-            return false unless bare_current_user_condition?(condition)
-
-            bare_return_branch?(node.else_branch) || bare_return_branch?(node.if_branch)
-          end
-
-          def bare_current_user_condition?(condition)
-            condition&.send_type? &&
-              condition.method_name == :current_user &&
-              condition.receiver.nil?
-          end
-
-          def bare_return_branch?(branch)
-            branch&.return_type? && branch.children.empty?
-          end
-
           # `if`/`unless` keyword forms have `loc.keyword`; ternary `?:` nodes
           # have `loc.question` instead. Fall back to the condition source range.
           def if_offense_location(node)
@@ -219,12 +248,6 @@ module RuboCop
             end
           end
 
-          # Is this send node an auth method call (`current_user`, `user_signed_in?`)
-          # on no receiver?
-          def auth_method_call?(node)
-            AUTH_METHODS.include?(node.method_name) && node.receiver.nil?
-          end
-
           # Is the send node used as a value (argument to another send, pair
           # value in a hash, etc.) rather than already caught as a branch condition?
           def used_as_value?(node)

data/lib/rubocop/cop/dev_doc/auth/current_user_branching_helpers.rb

@@ -0,0 +1,176 @@
+module RuboCop
+  module Cop
+    module DevDoc
+      module Auth
+        # Condition analysis for CurrentUserBranching, extracted so the cop
+        # class stays within size limits. Everything here answers one
+        # question: is this AST node auth-state/authorization branching?
+        #
+        # Three mechanisms cooperate (see the cop docstring for doctrine):
+        # - AUTH ROOTS: bare `current_user` / `user_signed_in?` calls, PLUS
+        #   any local/instance variable assigned from `current_user` in the
+        #   same file (taint tracking — `@user = current_user` must not be a
+        #   way to launder the branch). Taint is per-file: an ivar assigned in
+        #   a controller and read in a view is NOT tracked — the companion
+        #   role-predicate cop covers that gap receiver-agnostically.
+        # - ALLOWED METHODS: the first method called on an auth root is
+        #   classified. Data reads (`errors`, project-configured readers like
+        #   `otp_required_for_login`) pass; everything else — role predicates,
+        #   unknown methods — flags until someone classifies it in
+        #   `AllowedMethods` (a deliberate, reviewed decision).
+        # - GUARD EXEMPTION: bare-return nil guards in every spelling stay
+        #   allowed (the correct pre-auth pattern).
+        module CurrentUserBranchingHelpers
+          # Universal non-permission data reads, allowed WITHOUT configuration.
+          # Lives in code (not default.yml) so a project setting its own
+          # AllowedMethods cannot accidentally drop the baseline — RuboCop
+          # REPLACES array config wholesale, it does not merge. The yml key is
+          # therefore purely additive.
+          DEFAULT_ALLOWED_METHODS = %i[errors id email persisted? new_record?].freeze
+
+          # Nil-test spellings that keep the guard-return exemption; role/data
+          # chains never qualify.
+          NIL_TEST_METHODS = %i[present? blank? nil? !].freeze
+
+          # Identity comparisons are display logic, not access decisions.
+          IDENTITY_COMPARISON_METHODS = %i[== !=].freeze
+
+          def on_new_investigation
+            super
+            @tainted_names = collect_tainted_names(processed_source.ast)
+          end
+
+          private
+
+          # Names that are PURE aliases of current_user: every assignment to
+          # the name, file-wide, is an unconditional `= current_user`. An
+          # assignment under an `if` is semantic narrowing (`@user =
+          # current_user` only when a token matches — the variable is
+          # genuinely nilable, and branching on it is resource-presence
+          # logic), and an assignment from any other source makes it a
+          # general holder; either disqualifies the name. `case` dispatch
+          # (glib_load_resource's per-action assignment) does NOT disqualify —
+          # per-action aliasing is still pure aliasing.
+          def collect_tainted_names(ast)
+            names = Set.new
+            disqualified = Set.new
+            ast&.each_node(:lvasgn, :ivasgn) do |assign|
+              target = pure_alias_assignment?(assign) ? names : disqualified
+              target << assign.children[0]
+            end
+            names - disqualified
+          end
+
+          def pure_alias_assignment?(assign)
+            value = assign.children[1]
+            return false unless value&.send_type? && value.method_name == :current_user && value.receiver.nil?
+
+            assign.each_ancestor(:if).none?
+          end
+
+          def tainted_ref?(node)
+            node&.type?(:lvar, :ivar) && @tainted_names.include?(node.children.first)
+          end
+
+          def auth_condition?(condition)
+            return false unless condition
+            return tainted_ref?(condition) if condition.type?(:lvar, :ivar)
+            return auth_condition?(condition.children.last) if condition.begin_type?
+            return condition.children.any? { |operand| auth_condition?(operand) } if condition.type?(:and, :or)
+
+            condition.type?(:send, :csend) && auth_send_condition?(condition)
+          end
+
+          def auth_send_condition?(node)
+            return true if bare_auth_call?(node)
+            # Identity comparisons are exempt in BOTH directions
+            # (`x.user == current_user` and `current_user.id == x`), so test
+            # before the chain-root rule.
+            return false if IDENTITY_COMPARISON_METHODS.include?(node.method_name)
+            # `!current_user` / `!user_signed_in?` (or a negated chain)
+            return auth_send_condition?(node.receiver) if node.method_name == :! && node.receiver&.type?(:send, :csend)
+            return flagged_chain_off_auth_root?(node)  if chain_first_hop(node)
+
+            current_user_as_access_argument?(node)
+          end
+
+          # The first method called on an auth root is the classified one:
+          # `current_user.oauth_tokens.any?` classifies `oauth_tokens` (the
+          # rest operates on the returned data). Allowed data reads pass;
+          # role predicates and unknown methods flag.
+          def flagged_chain_off_auth_root?(node)
+            !allowed_method?(chain_first_hop(node).method_name)
+          end
+
+          # The send whose receiver IS an auth root (bare current_user or a
+          # tainted alias) — nil when the chain isn't rooted at auth state.
+          # `user_signed_in?` accepts no chain (it returns a bool).
+          def chain_first_hop(node)
+            current = node
+            while current.respond_to?(:receiver) && current.receiver
+              return current if auth_root?(current.receiver)
+
+              current = current.receiver
+            end
+            nil
+          end
+
+          def auth_root?(node)
+            (node.send_type? && node.method_name == :current_user && node.receiver.nil?) || tainted_ref?(node)
+          end
+
+          def bare_auth_call?(node)
+            node.send_type? && self.class::AUTH_METHODS.include?(node.method_name) && node.receiver.nil?
+          end
+
+          def allowed_method?(method_name)
+            DEFAULT_ALLOWED_METHODS.include?(method_name) ||
+              (cop_config['AllowedMethods'] || []).map(&:to_sym).include?(method_name)
+          end
+
+          # `admins.include?(current_user)` / `accessible_by?(current_user)`
+          # in a condition — an access decision parameterised by the current
+          # user (or a tainted alias); belongs in the policy.
+          def current_user_as_access_argument?(node)
+            return false if IDENTITY_COMPARISON_METHODS.include?(node.method_name)
+
+            node.arguments.any? do |arg|
+              (arg.send_type? && arg.method_name == :current_user && arg.receiver.nil?) || tainted_ref?(arg)
+            end
+          end
+
+          # `return unless current_user` (and every nil-test SPELLING of it,
+          # on current_user or a tainted alias) is the correct guard pattern —
+          # the cop polices branching, not guard orthography. Role/data chains
+          # (`return unless current_user.admin?`) do NOT qualify.
+          def bare_return_guard?(node)
+            return false unless pure_auth_state_test?(node.condition)
+
+            bare_return_branch?(node.else_branch) || bare_return_branch?(node.if_branch)
+          end
+
+          def pure_auth_state_test?(condition)
+            return false if condition.nil?
+            return true if tainted_ref?(condition)
+            return false unless condition.type?(:send, :csend)
+            return true if bare_current_user?(condition)
+
+            nil_test_of_auth_state?(condition)
+          end
+
+          def nil_test_of_auth_state?(node)
+            NIL_TEST_METHODS.include?(node.method_name) && node.receiver && pure_auth_state_test?(node.receiver)
+          end
+
+          def bare_current_user?(node)
+            node.method_name == :current_user && node.receiver.nil?
+          end
+
+          def bare_return_branch?(branch)
+            branch&.return_type? && branch.children.empty?
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/cop/dev_doc/auth/role_predicate_outside_policy.rb

@@ -0,0 +1,102 @@
+module RuboCop
+  module Cop
+    module DevDoc
+      module Auth
+        # Role predicates must not be called outside the policy layer.
+        #
+        # ## Rationale
+        # A role predicate (`admin?`, `super_admin?`,
+        # `effective_admin_of_organization?`, ...) answers "what may this
+        # person do?" — an authorization question. Scattering those calls
+        # through controllers and views fragments the permission model: the
+        # Pundit policy says one thing, page code quietly decides another.
+        #
+        # This cop is the receiver-agnostic companion to
+        # `DevDoc/Auth/CurrentUserBranching`: that cop tracks `current_user`
+        # and its same-file aliases, but taint cannot follow an ivar from a
+        # controller into a view, and any wrapper method breaks the chain.
+        # Keying on the PREDICATE NAME instead means `current_user.admin?`,
+        # `@user.admin?`, `user.admin?`, and `viewer.admin?` are all equally
+        # visible — no alias or wrapper hides the question being asked.
+        #
+        # ## Remedy
+        # Move the decision into the Pundit policy and query it where needed:
+        # `policy(record).manage?` — no role predicate at the call site.
+        # Name the policy query after the DECISION it guards (`auto_approve?`,
+        # `initiation_blocked_for_admin?`), never after the role: a generic
+        # getter (`user_is_admin?`) re-exports the scattering through the
+        # policy door — every call site still maps role to behavior itself.
+        # Genuine display logic keyed on a role (badges, admin-only hints)
+        # belongs in a helper (an excluded path), where the branching is
+        # openly presentation-side.
+        #
+        # ## The ratchet
+        # Once page code queries policies by purpose, add any role-shaped
+        # getters your policies DO export (`user_is_super_admin?`, ...) to
+        # RolePredicates. Policies are excluded paths, so policy-internal use
+        # stays free while new loose call sites in page code flag mechanically.
+        #
+        # ## Configuration
+        # `RolePredicates` is a closed, per-project list — add every role
+        # predicate your User/Member models define:
+        #
+        #   DevDoc/Auth/RolePredicateOutsidePolicy:
+        #     RolePredicates:
+        #       - admin?
+        #       - super_admin?
+        #       - effective_admin_of_organization?
+        #       - explicit_admin_of_organization?
+        #
+        # ## Allowed paths (Exclude:)
+        # By default the cop is silent in:
+        #   app/policies/**/*.rb   ← where the predicates belong
+        #   app/models/**/*.rb     ← where they are defined/composed
+        #   app/helpers/**/*.rb    ← sanctioned display branching
+        #   app/views/layouts/**/* ← sanctioned display branching
+        #   test/, spec/           ← tests assert role facts as fixture
+        #                            preconditions; they verify the permission
+        #                            model rather than fragment it
+        #
+        # @example
+        #   # bad — controller decides a permission by role
+        #   if current_user.admin?
+        #     auto_approve
+        #   end
+        #
+        #   # bad — the alias dodge is equally visible
+        #   if @user.admin?
+        #     auto_approve
+        #   end
+        #
+        #   # good — the policy owns the decision; page code queries it
+        #   if policy(@organization).auto_approve?
+        #     auto_approve
+        #   end
+        class RolePredicateOutsidePolicy < Base
+          MSG = '`%<method>s` is a role predicate — an authorization question that belongs in ' \
+                'the Pundit policy. Move the DECISION there and query it by purpose ' \
+                '(`policy(record).auto_approve?`) — name the query after the decision it ' \
+                'guards, never after the role (`user_is_admin?` just re-exports the ' \
+                'scattering through the policy door, and belongs in this cop\'s ' \
+                'RolePredicates list). For pure display branching (badges, admin hints), ' \
+                'use a helper. Renaming the receiver never exempts it: the flagged thing ' \
+                'is the question, not who is asked.'.freeze
+
+          def on_send(node)
+            method_name = node.method_name
+            return unless role_predicates.include?(method_name)
+
+            add_offense(node.loc.selector, message: format(MSG, method: method_name))
+          end
+          alias on_csend on_send
+
+          private
+
+          def role_predicates
+            @role_predicates ||= (cop_config['RolePredicates'] || []).map(&:to_sym)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/rubocop/dev_doc/version.rb

@@ -1,5 +1,5 @@
 module RuboCop
   module DevDoc
-    VERSION = "0.10.4".freeze
+    VERSION = "0.11.0".freeze
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rubocop-dev_doc
 version: !ruby/object:Gem::Version
-  version: 0.10.4
+  version: 0.11.0
 platform: ruby
 authors:
 - dev-doc contributors
 autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-07-09 00:00:00.000000000 Z
+date: 2026-07-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -97,7 +97,9 @@ files:
 - lib/dev_doc/test/pseudo_i18n_crawler.rb
 - lib/rubocop-dev_doc.rb
 - lib/rubocop/cop/dev_doc/auth/current_user_branching.rb
+- lib/rubocop/cop/dev_doc/auth/current_user_branching_helpers.rb
 - lib/rubocop/cop/dev_doc/auth/load_resource_current_user_guard.rb
+- lib/rubocop/cop/dev_doc/auth/role_predicate_outside_policy.rb
 - lib/rubocop/cop/dev_doc/i18n/avoid_titleize_humanize.rb
 - lib/rubocop/cop/dev_doc/i18n/localizable_props.rb
 - lib/rubocop/cop/dev_doc/i18n/report_text.rb