varvet / pundit

Minimal authorization through OO design and pure Ruby classes
MIT License
8.29k stars 632 forks source link

Testing `permitted_attributes` for `nested_attributes` #645

Closed Stivaros closed 2 years ago

Stivaros commented 4 years ago

I have used the gem to implement permitted_attributes for a subset of the nested_attributes on a model for a specific user, i.e. a user with a certain role can only update certain attributes on a nested model and none on the model itself. I can currently test this manually but am struggling to add a spec to my test suite.

The README encourages the use of pundit-matchers and I have found it useful for permitted_attributes but unfortunately it appears as though the gem doesn't support nested_attributes (issue #7) and may also be unmaintained at this point?

I imagine I'm not alone in wanting to test this at policy level so would be interested in learning how others are achieving this. Once I know I'm happy to update the documentation to help others in future.