wor-simple_crud 0.2.1 → 0.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0f3a2ed3cb6cea9416a6a745959519ccfdd9fd3a35667432939ece4291368266
-  data.tar.gz: 6b0625c10d66661cff9b09959ddd7f1a0eae630c0a519fa34116855b38588377
+  metadata.gz: e280efd8ead44768d16e0ba663e25a40d6972b53e253281d1c7eac0735421b64
+  data.tar.gz: 78625a2a759ca5fda1e7d41e421db92ed721f2e2c343524f0580cd810d32ac7a
 SHA512:
-  metadata.gz: c4b2ab3b62121f5409a0d11d498a094162f847027941deb4abb3c72dc0c5c623934c3aeee5a65c64149039fbf2c09d4e9f9a8e10da6818ad32e236545e592331
-  data.tar.gz: 75211a88220e4328897ba0c36ebd55b04742bc253874f711cf14e644ff5a9d595455003facfb7ad9896346e63570d6dffb36fbeb947e34261a17e38ddb60aa80
+  metadata.gz: 406a83cc98deaa7fa3ba5f7ccb9a12486a903b6aef81bddd0a5f4f9c595ffa64e7414cb8a718d4a4fe96f987fcefaf34a8b201cbe16aab4db2721eea0bd19397
+  data.tar.gz: 7177530ba1a01fcf526c406a14f3bf64bfcf895ce5675f4acca5f24f28c57db90859ddab43866d314f70e723cfebda24bc5930d64ac66a01d29bc6246792c04a

data/.gitignore

@@ -147,6 +147,11 @@ config/initializers/secret_token.rb
 ## Environment normalization:
 /.bundle
 /vendor/bundle
+# Appraisal gemfiles vendor their own bundles; never commit those.
+/gemfiles/.bundle/
+/gemfiles/vendor/
+# Local tooling logs.
+/.setting/
 
 # these should all be checked in to normalize the environment:
 # Gemfile.lock, .ruby-version, .ruby-gemset

data/CHANGELOG.md

@@ -1,5 +1,51 @@
 ## Change log
 
+### V0.3.1
+
+Shared examples configuration:
+* Every setting can be overridden per controller or per example via `simple_crud:` RSpec metadata. Metadata takes precedence over `SimpleCrud::RSpec.configure` and the defaults, and all reads happen at example runtime, so per-resource tweaks need no around hooks, no global mutation and no restore logic.
+* New `model_attributes` setting (default: `{ owner_association => current_user }`) decides how records are built for the examples, so multi-key (`{ user:, project: }`), non-user-owned (`{ project: project }`) or owner-less models work without editing the shared examples.
+* Dedicated examples (`*_with_block`, `*_with_build`, `*_with_scope`) no longer assume the gem's dummy app: request params derive from `params_for`/`owner_params`, authentication wraps conditionally on the action's `authenticate:` option, and render-block actions are asserted on status and persistence effects only (a block's response body is app-defined by definition).
+* The finder/build dedicated families (`show/update/destroy with finder`, `not found with finder`, `new with build`) adapt to each action's declared options too: render-block actions are asserted success-only, `html: true` actions assert the rendered template or redirect, and plain JSON keeps the status/body assertions. Server-rendered apps no longer need to skip these families.
+* `index with scope` builds its records through new `scoped_attributes` (default: `model_attributes`) and `other_scoped_attributes` (default: `model_attributes.merge(owner_association => other_user)`) settings instead of hardcoding `owner_association => user`, so factories without that attribute keep working and multi-key models express their scope via metadata. The assertion follows the controller: `assigns(:records)` ids for `html: true`, the wor-paginate envelope for paginated JSON, and the bare serialized array otherwise.
+* Actions declared with a render block expose `block: true` in the controller metadata, and the shared examples treat them accordingly: failure/invalid paths assert persistence effects only (the block decides how the response is rendered), while default flows keep their pinned statuses/templates.
+* The base destroy example covers the failure path (record always kept; non-block flows respond 422 as JSON or re-render `show` as HTML).
+* New optional `created_record_check` setting: a lambda receiving the persisted record in the create/update success paths, to assert ownership/scope that `count == 1` alone can't catch.
+
+### V0.3.0
+
+Server-rendered (HTML) support:
+* `html: true` or a render block on every action: `:index` renders `index.html.erb` with the paginated records as `@records`; `:show`/`:new` expose `@record`; `:create`/`:update` redirect to the record on success and re-render the form with errors on failure; `:destroy` redirects to the collection (re-rendering `show.html.erb` when a callback aborts). Blocks receive the records (`:index`), the record (`:show`/`:new`) or `(record, saved)` (`:create`/`:update`/`:destroy`) and override the auto-render.
+* New `:new` action: builds a record, authorizes it, and renders `new.html.erb` (or returns JSON in API mode).
+
+Custom lookups, scoping and building:
+* `finder:` on `:show`/`:update`/`:destroy`/`:edit`: a `Proc`/lambda invoked with the controller's params, or a `Symbol` naming a class method on the model. Defaults to `klass.find(params[:id])`.
+* New `simple_crud_for :edit`: the find-instead-of-build twin of `:new`. It looks the record up (honoring `finder:`), authorizes it and renders `edit.html.erb` with `@record` in HTML mode, returning the record as JSON otherwise. A matching `simple crud for edit` shared example covers the authorized/denied, not-found and html/json/block paths.
+* `build:` on `:new`/`:create` for owner-scoped or nested builds (`current_user.projects.build`); runs with the controller as `self`, and `:create` assigns the permitted params to the built record before saving.
+* With `authorize: true`, `:index` paginates the Pundit `policy_scope` of the model (falling back to the full relation when no `Scope` is defined) instead of `klass.all`, with a per-action `scope: ->(user[, params]) { ... }` override.
+* `redirect:` on HTML-mode `:create`/`:update`/`:destroy`: a `Proc` called with the record, or a literal path, overriding the default success redirect.
+
+Validation errors:
+* `:create` returns `201` / `422 { errors: [...] }` and `:update` returns `200` / `422` instead of raising; `raise_on_invalid: true` keeps strict `create!`/`update!` semantics.
+
+Authorization changes:
+* Breaking: `authorize: true` now always enforces policy checks, including for `authenticate: false` actions, which reach policies with a `nil` user. Policies must tolerate a `nil` user.
+* Breaking: `:index` authorizes the model class instead of an unsaved instance, matching the Pundit/CanCanCan collection conventions. `index?` policies can no longer inspect record state (there is none), so write them against the user.
+* `SimpleCrud::Config.user_method` (default `:current_user`) selects the controller method providing the user to policies and scope lambdas, so apps with other conventions (`current_admin`, ...) need no shims.
+
+Adapter interfaces:
+* Authorization adapters gain `policy_scope`; pagination adapters gain `paginated_records`, so HTML-mode `:index` can fetch the current page without rendering. Both are implemented by every shipped adapter (Pundit, CanCanCan, Action Policy / wor-paginate, Kaminari, will_paginate, Pagy).
+
+Fixes:
+* Kaminari adapter: string query params corrupted offsets (`?page=3&per_page=10` resolved to `OFFSET 1010`), and `per_page` now respects `Kaminari.config.max_per_page`.
+* Custom finders returning anything but a single record raise `ActiveRecord::RecordNotFound` instead of failing later with an obscure error.
+* Invalid `simple_crud_for` usage (unknown action, missing policy, missing serializer) raises `ArgumentError` instead of throwing uncatchable string tags.
+
+Testing library:
+* The shared examples are a reusable library: configure via `SimpleCrud::RSpec.configure`, wire up explicitly with `SimpleCrud::RSpec.install!`. Every app-specific assumption has an overridable default matching the gem's own stack (Devise-JWT + FactoryBot + Pundit + AMS): `authenticate`/`current_user`/`other_user`, `create_record`/`create_records`/`params_for`, `owner_association`/`required_attribute`/`required_error`, `finder_key`, `params_key`, `route_params`, `invalid_status`, `unauthenticated_status`, `assert_html_template`, `policy_class`, `serializer_class`.
+* Examples are HTML-aware (branching on the `html:` option, inferring it for block-form actions) and issue requests by action name, so one set covers API and server-rendered controllers, namespaced and nested routes alike.
+* Refactor `SimpleCrudController` helpers into `SimpleCrud::ControllerHelpers`, dedupe repeated test code, and require `rails-controller-testing` for template assertions. Tested across Rails 6.1-8.1.
+
 ### V0.2.1
 * Rename the published gem from `simple_crud` to `wor-simple_crud`. `simple_crud` is already taken on RubyGems by an unrelated gem, and RubyGems also rejects names that differ from an existing one only by hyphen/underscore (so `simple-crud` was rejected too). Install with `gem 'wor-simple_crud', require: 'simple_crud'` (the require path is unchanged).
 * Drop the last Wolox references now that this gem lives at icoluccio/simple-crud, and point the wor-paginate link and CI/gem badges at their new homes.

data/Gemfile

@@ -28,6 +28,7 @@ group :development, :test do
   gem 'overcommit', '~> 0.72'
   gem 'pagy', '~> 43.0', require: false
   gem 'pundit', '~> 2.5'
+  gem 'rails-controller-testing', '~> 1.0'
   gem 'rake', '~> 13.4'
   gem 'rspec', '~> 3.13'
   gem 'rspec-rails', '>= 6.0', '< 9'

data/README.md

@@ -14,7 +14,10 @@ SimpleCrud
       - [Options](#options)
         - [Paginate](#paginate)
         - [Authorize](#authorize)
+        - [Authenticate](#authenticate)
         - [Serializer](#serializer)
+        - [HTML](#html)
+        - [Finder](#finder)
       - [Shared examples](#shared-examples)
   - [Contributing](#contributing)
   - [Releases](#releases)
@@ -64,7 +67,7 @@ Before SimpleCrud can be used, some boilerplate is needed. Add the following to
 ```ruby
 include Pundit::Authorization
 include Wor::Paginate
-extend SimpleCrud
+extend SimpleCrudController
 
 before_action :set_params
 
@@ -91,6 +94,8 @@ simple_crud_for :show
 simple_crud_for :index
 simple_crud_for :create
 simple_crud_for :destroy
+simple_crud_for :new
+simple_crud_for :edit
 ```
 
 Each method supports different options, as in:
@@ -102,6 +107,12 @@ simple_crud_for :index, paginate: false, authorize: false, serializer: CustomSer
 - Authorize: whether it should check authorization via the configured authorization adapter (Pundit by default)
 - Authenticate: whether it should use Devise to check for a current_user
 - Serializer: specify a particular serializer you should use
+- Html: renders the action's ERB template instead of JSON (valid for `:index`, `:show`, `:new`, `:edit`, `:create`, `:update` and `:destroy`). Only meaningful in controllers that render templates
+- Scope: only valid for `:index`. A `Proc`/`lambda` taking `current_user` (plus the controller's `params` if it takes a second argument) that returns the relation to list, overriding the default `policy_scope`. The user is resolved via `SimpleCrud::Config.user_method` (`:current_user` by default; set it to e.g. `:current_admin`)
+- Finder: only valid for `:show`, `:update`, `:destroy` and `:edit`. A `Proc`/`lambda` (invoked with the controller's params) or a `Symbol` naming a class method on the model, used to look up the record instead of `klass.find(params[:id])`.
+- Build: only valid for `:new` and `:create`. A `Proc`/`lambda` that builds the record (invoked with the controller as `self`, so `current_user`, `params` and any instance variables are available), for building nested or owner-scoped records like `current_user.projects.build`. `:create` then assigns the permitted params to the built record before saving
+- Raise_on_invalid: only valid for `:create` and `:update`. Keeps the strict `create!`/`update!` semantics (raising on invalid input) instead of returning `422` with the validation errors
+- Redirect: only valid for HTML-mode `:create`, `:update` and `:destroy`. A `Proc`/`lambda` (called with the record) or a literal path used as the success redirect target. Defaults to the record (`:create`/`:update`) or the model's collection path (`:destroy`)
 
 You'll need a few things so they work correctly:
 
@@ -143,10 +154,11 @@ end
 
 SimpleCrud.configure { |config| config.pagination_adapter = MyPaginationAdapter.new }
 ```
-
 #### Authorize
 Authorization checks go through [Pundit](https://github.com/varvet/pundit) by default. Name the policy after the model plus `Policy`, e.g. `AuthorPolicy`, written as a regular Pundit policy:
 
+> **Note:** authorization runs whenever `authorize: true`, independently of `authenticate`. With no signed-in user the policy receives `nil` as the user, so write policies that tolerate it (e.g. `user.nil? ? false : ...`). Devise provides `authenticate_user!` and `current_user` for you; non-Devise apps must define a `current_user` (or point `SimpleCrud::Config.user_method` at their own method) for policies and `scope:` lambdas to receive the user.
+
 ```ruby
 class AuthorPolicy
   attr_reader :user, :author
@@ -159,10 +171,30 @@ class AuthorPolicy
   def show?
     user.present?
   end
+
+  class Scope
+    def initialize(user, scope)
+      @user = user
+      @scope = scope
+    end
+
+    # Used by :index to scope the listed records to the current user.
+    def resolve
+      @scope.where(user: @user)
+    end
+  end
 end
 
 ```
 
+When `authorize: true`, the `:index` action paginates the Pundit `policy_scope` of the model (falling back to the full relation when no `Scope` is defined) instead of `klass.all`, so "only my records" scoping works out of the box. Override the scope per action with the `scope:` option, a callable that receives the user resolved via `SimpleCrud::Config.user_method` (`nil` when there is none, and `params` too when it takes a second argument):
+
+```ruby
+SimpleCrud.configure { |c| c.user_method = :current_admin } # non-Devise naming conventions
+simple_crud_for :index, scope: ->(user) { Model.visible_to(user) }
+simple_crud_for :index, scope: ->(user, params) { Model.where(status: params[:status]).visible_to(user) }
+```
+
 Prefer CanCanCan or Action Policy instead? Both have adapters ready to go:
 
 ```ruby
@@ -200,6 +232,13 @@ class MyAuthorizationAdapter
   def policy_defined?(model_class)
     Kernel.const_defined?("#{model_class}Policy")
   end
+
+  # Called when rendering :index with authorize: true. Must return the
+  # relation the current user is allowed to list. The default returns
+  # the full relation.
+  def policy_scope(controller, model_class)
+    model_class.all
+  end
 end
 
 SimpleCrud.configure do |config|
@@ -219,6 +258,67 @@ class AuthorSerializer < ActiveModel::Serializer
 end
 ```
 
+#### HTML
+For server-rendered apps, `html: true` renders the action's ERB template instead of JSON, so be sure the controller can render templates (e.g. `ActionController::Base`). Behavior per action:
+
+- `:index` renders `index.html.erb` with the paginated records exposed as `@records` (pagination still applies, or use `paginate: false`).
+- `:show` renders `show.html.erb` with the record exposed as `@record` (custom `finder:` still applies).
+- `:new` builds a new record, authorizes it, and renders `new.html.erb` with it exposed as `@record`.
+- `:edit` looks the record up (honoring `finder:`), authorizes it, and renders `edit.html.erb` with it exposed as `@record`.
+- `:create` saves and redirects to the created record on success, or re-renders `new.html.erb` (with `@record` and its errors) on failure.
+- `:update` saves and redirects to the record on success, or re-renders `edit.html.erb` on failure.
+- `:destroy` destroys and redirects to the collection (`redirect_to Model`) on success, or re-renders `show.html.erb` if a callback aborts the destroy.
+
+```ruby
+simple_crud_for :index, html: true
+simple_crud_for :show, html: true
+simple_crud_for :new, html: true
+simple_crud_for :edit, html: true
+simple_crud_for :create, html: true
+simple_crud_for :update, html: true
+simple_crud_for :destroy, html: true
+```
+
+Or pass a block that renders explicitly, overriding the auto-render. The block receives the records for `:index`, the record for `:show`/`:new`, or the record plus a saved flag for `:create`/`:update`/`:destroy`. Passing a block also implies `html: true` for the shared examples (so a server-rendered block is asserted as HTML); if your block renders JSON instead, pass `html: false` explicitly:
+
+```ruby
+simple_crud_for :index do |records|
+  render :index, locals: { models: records }
+end
+
+simple_crud_for :create do |record, saved|
+  saved ? redirect_to(record) : render(:new, locals: { model: record })
+end
+```
+
+#### Build
+`simple_crud_for :new` and `simple_crud_for :create` build the record with `klass.new`, which can't express owner-scoped or nested records (`current_user.projects.build`, `@project.tasks.build`). Pass a `build:` lambda; it runs with the controller as `self`, so `current_user`, `params` and any instance variables set by a `before_action` are available:
+
+```ruby
+simple_crud_for :new, build: -> { current_user.projects.build }
+simple_crud_for :create, build: -> { @project.tasks.build }
+```
+
+`:create` assigns the permitted params to the built record before saving, so the owner/parent association survives. `:update` keeps finding the record via the `finder:`.
+
+#### Edit
+`simple_crud_for :edit` is the find-instead-of-build twin of `:new`, the last hand-written CRUD action in server-rendered apps. It looks the record up (honoring `finder:` exactly like `:show`), authorizes it, and renders `edit.html.erb` with the record exposed as `@record`; in JSON mode it returns the record:
+
+```ruby
+simple_crud_for :edit, finder: ->(params) { Project.find_by!(slug: params[:slug]) }
+```
+
+#### Finder
+By default records are looked up by primary key via `klass.find(params[:id])`. The `finder:` option on `:show`, `:update` and `:destroy` replaces that with any lookup you want: pretty URLs (`resources :posts, param: :slug`), tokens, composite keys, or scoping by a parent resource. Pass a `Proc`/`lambda` that maps the controller's `params` to a record, or a `Symbol` naming a class method on the model that takes the params:
+
+```ruby
+simple_crud_for :show, finder: ->(params) { Model.find_by!(token: params[:token]) }
+simple_crud_for :update, finder: :find_by_slug
+simple_crud_for :destroy, finder: ->(params) { current_user.models.find(params[:id]) }
+```
+
+When omitted it defaults to `klass.find(params[:id])`, and `not_found` is still returned whenever the finder finds no record.
+
 ### Shared examples
 While optional, using the included shared examples saves you from writing the standard test cases for the methods. You can even use them if you didn't use `simple_crud_for`, as a set of basic tests. To include them, just add `require 'simple_crud/rspec'` to your `rails_helper.rb` file and add the lines you need to your `*_spec.rb` files:
 ```ruby
@@ -233,8 +333,106 @@ describe V1::Backoffice::AuthorsController do
 end
 ```
 
+The `create` and `update` examples cover the `422` response with validation errors (skipped when `raise_on_invalid: true`, or whenever the action uses a render block, since the block decides how the response is rendered), and all base examples adapt to `html: true` controllers (asserting the rendered template/redirect instead of JSON). Controllers using the extra options can include their dedicated examples too:
+
+```ruby
+include_examples 'simple crud for new'                    # the :new action
+include_examples 'simple crud for edit'                   # the :edit action
+include_examples 'simple crud for index with block'      # render block
+include_examples 'simple crud for index with scope'      # scope: ->(user) { ... }
+include_examples 'simple crud for show with block'       # render block on :show
+include_examples 'simple crud for new with block'        # render block on :new
+include_examples 'simple crud for create with block'     # render block on :create
+include_examples 'simple crud for destroy with block'    # render block on :destroy
+include_examples 'simple crud for show with finder'      # finder on :show
+include_examples 'simple crud for update with finder'    # finder on :update
+include_examples 'simple crud for destroy with finder'   # finder on :destroy
+include_examples 'simple crud for new with build'        # build: -> { ... } on :new
+include_examples 'simple crud for create with build'     # build: -> { ... } on :create
+```
+
 It's not needed to specify paginate: true and such, since the shared examples will use the configuration that was originally passed to simple_crud_for
 
+#### Adopting the shared examples
+The shared examples assume the gem's own stack by default (Devise-JWT authentication, FactoryBot, Pundit, ActiveModel Serializers). Wiring is opt-in: require the file and call `SimpleCrud::RSpec.install!` in `spec/spec_helper.rb` (or `rails_helper.rb`), then configure anything your app differs on:
+
+```ruby
+SimpleCrud::RSpec.configure do |config|
+  # How the current user (and a secondary "other user") is built.
+  config.current_user = -> { User.create!(email: 'user@example.com', password: 'secret') }
+  config.other_user = -> { User.create!(email: 'other@example.com', password: 'secret') }
+
+  # How to sign the current user in for a request (no Devise-JWT here).
+  config.authenticate = -> { request.session[:user_id] = current_user.id }
+
+  # How records and create/update params are built (no FactoryBot here).
+  config.create_record = ->(klass, attributes) { klass.create!(attributes) }
+  config.create_records = ->(klass, count, attributes) { count.times.map { klass.create!(attributes) } }
+  config.params_for = ->(klass) { klass.new.attributes.slice('title') }
+
+  # The owner association used when building records for the examples
+  # (model_attributes defaults to `{ owner_association => current_user }`;
+  # override model_attributes directly for multi-key or non-user-owned models).
+  config.owner_association = :owner
+  config.model_attributes = -> { { owner: current_user } }
+  config.required_attribute = :title
+  config.required_error = "Title can't be blank"
+
+  # Redirect-based apps: unauthenticated requests get a redirect, not a 401.
+  # And if the rendered template name doesn't match the action, drop the
+  # render_template assertion.
+  config.unauthenticated_status = :found
+  config.assert_html_template = false
+
+  # Server-rendered apps usually use nested strong params
+  # (params.require(:task).permit(:name)); wrap request bodies under the
+  # model's params key instead of posting flat params.
+  config.params_key = :task
+
+  # Nested resources (/projects/:project_slug/tasks): extra params
+  # (e.g. the parent slug) added to every request.
+  config.route_params = -> { { project_slug: project.slug } }
+
+  # Re-render the form with a 422 on validation failure (instead of 200).
+  config.invalid_status = :unprocessable_entity
+
+  # How the 'simple crud for index with scope' example builds the records
+  # that match the controller's scope and the ones that must be excluded.
+  # Defaults derive from model_attributes (mine) plus an owner_association
+  # => other_user variant (theirs); override both when your scope keys on
+  # something other than the owner association.
+  config.scoped_attributes = -> { { project: project } }
+  config.other_scoped_attributes = -> { { project: other_project } }
+
+  # Pundit policy and serializer class lookup.
+  config.policy_class = ->(klass) { "#{klass}Policy".constantize }
+  config.serializer_class = ->(model) { "#{model.class}Serializer".constantize }
+
+  # Optional extra assertions on the persisted record in the create/update
+  # success paths (catches regressions that save into the wrong parent).
+  config.created_record_check = ->(record) { expect(record.project).to eq(project) }
+end
+```
+
+Each setting has a sensible default, so you only override what differs. Callable settings (`current_user`, `authenticate`, `create_record`, `create_records`, `params_for`, `model_attributes`, `scoped_attributes`, `other_scoped_attributes`, `policy_class`, `serializer_class`) run in the example-group context, so they can call `request`, `create`, `current_user`, etc.; `created_record_check` receives the persisted record. The examples are controller-agnostic (they issue requests by action name, not hardcoded paths), so they work for namespaced and nested controllers alike. If you keep `assert_html_template` on (the default), add `gem 'rails-controller-testing'` for the `render_template` matcher.
+
+#### Per-controller overrides via metadata
+
+Any setting can also be overridden per controller (or per example) with `simple_crud:` metadata instead of globally, useful when the app matches the defaults except for one resource. Metadata wins over global config, and every read happens at example runtime, so there are no around hooks or state to restore:
+
+```ruby
+RSpec.describe TasksController, type: :controller, simple_crud: {
+  model_attributes: -> { { project: project } },
+  route_params: -> { { project_slug: project.slug } }
+} do
+  let(:project) { create(:project, owner: current_user) }
+
+  include_examples 'simple crud for show'
+end
+```
+
+Callable settings resolve in the example context, so their lambdas can close over the spec's `let`s; that's how records land in the same project the route params point at.
+
 ## Contributing
 
 1. Fork it

data/lib/simple_crud/action_lambdas.rb

@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+
+module SimpleCrud
+  # Builds the lambda installed as each action declared with simple_crud_for.
+  module ActionLambdas
+    def crud_lambda_for_show(klass, parameters = {}, &block)
+      lambda do
+        authenticate_user! if parameters[:authenticate]
+        requested = SimpleCrudController.find_record(klass, self, parameters)
+
+        options = {}.merge(serializer: parameters[:serializer]).compact
+        SimpleCrudController.maybe_authorize(self, requested, parameters)
+        SimpleCrudController.render_show(self, requested, options, parameters, &block)
+      end
+    end
+
+    def crud_lambda_for_new(klass, parameters = {}, &block)
+      lambda do
+        authenticate_user! if parameters[:authenticate]
+        record = SimpleCrudController.build_record(self, klass, parameters)
+        SimpleCrudController.maybe_authorize(self, record, parameters)
+        SimpleCrudController.render_new(self, record, parameters, &block)
+      end
+    end
+
+    # The find-instead-of-build twin of :new.
+    def crud_lambda_for_edit(klass, parameters = {}, &block)
+      lambda do
+        authenticate_user! if parameters[:authenticate]
+        requested = SimpleCrudController.find_record(klass, self, parameters)
+        SimpleCrudController.maybe_authorize(self, requested, parameters)
+        SimpleCrudController.render_edit(self, requested, parameters, &block)
+      end
+    end
+
+    def crud_lambda_for_index(klass, parameters = {}, &block)
+      lambda do
+        authenticate_user! if parameters[:authenticate]
+        SimpleCrudController.maybe_authorize(self, klass, parameters)
+        options = {}.merge(each_serializer: parameters[:serializer]).compact
+        SimpleCrudController.render_index(self, klass, options, parameters, &block)
+      end
+    end
+
+    def crud_lambda_for_create(klass, parameters = {}, &block)
+      lambda do
+        authenticate_user! if parameters[:authenticate]
+        permitted_params = send("#{self.class.simple_crud_controller_model.to_s.underscore}_params")
+        record = SimpleCrudController.build_record(self, klass, parameters)
+        record.assign_attributes(permitted_params)
+        SimpleCrudController.maybe_authorize(self, record, parameters)
+        persist = ->(bang:) { bang ? record.save! : record.save }
+        options = { status: :created, failure_template: :new }
+        SimpleCrudController.save_and_render(self, record, parameters, options, persist, &block)
+      end
+    end
+
+    def crud_lambda_for_update(klass, parameters = {}, &block)
+      lambda do
+        authenticate_user! if parameters[:authenticate]
+        requested = SimpleCrudController.find_record(klass, self, parameters)
+        SimpleCrudController.maybe_authorize(self, requested, parameters)
+        permitted_params = send("#{self.class.simple_crud_controller_model.to_s.underscore}_params")
+        persist = ->(bang:) { bang ? requested.update!(permitted_params) : requested.update(permitted_params) }
+        options = { status: :ok, failure_template: :edit }
+        SimpleCrudController.save_and_render(self, requested, parameters, options, persist, &block)
+      end
+    end
+
+    def crud_lambda_for_destroy(klass, parameters = {}, &block)
+      lambda do
+        authenticate_user! if parameters[:authenticate]
+        requested = SimpleCrudController.find_record(klass, self, parameters)
+        SimpleCrudController.maybe_authorize(self, requested, parameters)
+        options = { status: :ok, failure_template: :show, redirect: parameters[:redirect] || klass }
+        persist = ->(bang:) { bang ? requested.destroy! : requested.destroy }
+        SimpleCrudController.persist_and_render(self, requested, parameters, options, persist, &block)
+      end
+    end
+  end
+end

data/lib/simple_crud/authorization/adapter.rb

@@ -15,6 +15,13 @@ module SimpleCrud
       def policy_defined?(model_class)
         raise NotImplementedError
       end
+
+      # Called when rendering :index with authorize: true. Must return the
+      # relation the current user is allowed to list. Defaults to the full
+      # relation so no scoping dependency is required.
+      def policy_scope(_controller, model_class)
+        model_class.all
+      end
     end
   end
 end

data/lib/simple_crud/authorization/pundit_adapter.rb

@@ -16,6 +16,12 @@ module SimpleCrud
       def policy_defined?(model_class)
         Kernel.const_defined?("#{model_class}Policy")
       end
+
+      def policy_scope(controller, model_class)
+        controller.send(:policy_scope, model_class)
+      rescue Pundit::NotDefinedError
+        model_class.all
+      end
     end
   end
 end

data/lib/simple_crud/config.rb

@@ -4,7 +4,7 @@ module SimpleCrud
   # Holds simple_crud's configurable pieces, set via SimpleCrud.configure.
   class Config
     class << self
-      attr_writer :authorization_adapter, :pagination_adapter
+      attr_writer :authorization_adapter, :pagination_adapter, :user_method
 
       def authorization_adapter
         @authorization_adapter ||= begin
@@ -19,6 +19,11 @@ module SimpleCrud
           Pagination::WorPaginateAdapter.new
         end
       end
+
+      # Controller method providing the current user; override for non-Devise apps.
+      def user_method
+        @user_method ||= :current_user
+      end
     end
   end
 end

data/lib/simple_crud/controller_helpers.rb

@@ -0,0 +1,128 @@
+# frozen_string_literal: true
+
+module SimpleCrud
+  # Class-level helpers shared by the CRUD lambdas defined in SimpleCrudController.
+  module ControllerHelpers
+    def maybe_authorize(controller, record, parameters)
+      return unless parameters[:authorize]
+
+      SimpleCrud::Config.authorization_adapter.authorize(controller, record)
+    end
+
+    def render_index(controller, klass, options, parameters, &block)
+      relation = index_relation(controller, klass, parameters)
+
+      if parameters[:html] || block
+        records = index_records(controller, relation, options, parameters)
+        controller.instance_variable_set(:@records, records)
+        block ? controller.instance_exec(records, &block) : controller.render(:index)
+      elsif parameters[:paginate]
+        SimpleCrud::Config.pagination_adapter.paginate(controller, relation, options)
+      else
+        controller.render({ json: relation }.merge(options))
+      end
+    end
+
+    def render_show(controller, record, options, parameters, &block)
+      if parameters[:html] || block
+        controller.instance_variable_set(:@record, record)
+        block ? controller.instance_exec(record, &block) : controller.render(:show)
+      else
+        controller.render({ json: record }.merge(options))
+      end
+    end
+
+    def render_new(controller, record, parameters, &block)
+      render_form(controller, record, :new, parameters, &block)
+    end
+
+    def render_edit(controller, record, parameters, &block)
+      render_form(controller, record, :edit, parameters, &block)
+    end
+
+    def render_form(controller, record, template, parameters, &block)
+      if parameters[:html] || block
+        controller.instance_variable_set(:@record, record)
+        block ? controller.instance_exec(record, &block) : controller.render(template)
+      else
+        options = {}.merge(serializer: parameters[:serializer]).compact
+        controller.render({ json: record }.merge(options))
+      end
+    end
+
+    def build_record(controller, klass, parameters)
+      parameters[:build] ? controller.instance_exec(&parameters[:build]) : klass.new
+    end
+
+    def index_relation(controller, klass, parameters)
+      if parameters[:scope]
+        call_scope(parameters[:scope], controller)
+      elsif parameters[:authorize]
+        SimpleCrud::Config.authorization_adapter.policy_scope(controller, klass)
+      else
+        klass.all
+      end
+    end
+
+    def call_scope(scope, controller)
+      user_method = SimpleCrud::Config.user_method
+      user = controller.respond_to?(user_method) ? controller.public_send(user_method) : nil
+      return scope.call(user) if scope.arity == 1
+
+      scope.call(user, controller.params)
+    end
+
+    def index_records(controller, relation, options, parameters)
+      return relation unless parameters[:paginate]
+
+      SimpleCrud::Config.pagination_adapter.paginated_records(controller, relation, options)
+    end
+
+    def find_record(klass, controller, parameters)
+      record = lookup_record(klass, controller, parameters)
+      raise ActiveRecord::RecordNotFound, "couldn't find #{klass}" if record.nil?
+      unless record.is_a?(ActiveRecord::Base)
+        raise ActiveRecord::RecordNotFound, "#{klass} finder must return a single record"
+      end
+
+      record
+    end
+
+    def lookup_record(klass, controller, parameters)
+      finder = parameters[:finder]
+      return klass.find(controller.params[:id]) if finder.nil?
+      return klass.send(finder, controller.params) unless finder.respond_to?(:call)
+
+      finder.call(controller.params)
+    end
+
+    def persist_and_render(controller, record, parameters, options, persist, &block)
+      saved = parameters[:raise_on_invalid] ? persist.call(bang: true) : persist.call(bang: false)
+      return render_persisted(controller, record, saved, options) unless block || parameters[:html]
+
+      controller.instance_variable_set(:@record, record)
+      return controller.instance_exec(record, saved, &block) if block
+
+      if saved
+        controller.redirect_to(redirect_target(controller, record, options[:redirect]))
+      else
+        controller.render(options[:failure_template])
+      end
+    end
+
+    def save_and_render(controller, record, parameters, options, persist, &block)
+      persist_and_render(controller, record, parameters,
+                         options.merge(redirect: parameters[:redirect] || record), persist, &block)
+    end
+
+    def redirect_target(controller, record, target)
+      target.is_a?(Proc) ? controller.instance_exec(record, &target) : target
+    end
+
+    def render_persisted(controller, record, saved, options)
+      return controller.render(json: record, status: options[:status]) if saved
+
+      controller.render json: { errors: record.errors.full_messages }, status: 422
+    end
+  end
+end

data/lib/simple_crud/pagination/adapter.rb

@@ -6,7 +6,13 @@ module SimpleCrud
     # (the default, see WorPaginateAdapter).
     module Adapter
       # Called when paginate: true. Must render the response itself.
-      def paginate(controller, klass, options)
+      def paginate(controller, relation, options)
+        raise NotImplementedError
+      end
+
+      # Called when rendering :index as HTML (html: true or a block given) and
+      # paginate: true. Must return the current page's records without rendering.
+      def paginated_records(controller, relation, options)
         raise NotImplementedError
       end
     end