Closed vivekmiyani closed 2 years ago
Happy to raise an PR, if this is really an issue 😃 .
Hi all. We have a trouble with current changes: we were using this feature as current manner:
authorize([initial_country, target_country], policy_class: CountryPolicy)
and inside CountryPolicy:
def copy_to_country?
initial_country, target_country = record
country_allowed?(initial_country.country) && country_allowed?(target_country)
end
and now there is no way to get initial_country. Record is always target_country
@iggant I'm afraid this doesn't look like a valid use of Pundit?
When passing an array, this is interpreted as namespacing, as documented in the README: https://github.com/varvet/pundit#policy-namespacing
It seems that the thing which made your code work before was a bug in the code for handling namespacing, which was raised in this issue.
Pundit is designed to authorise access to individual resources: passing arbitrary ruby objects (like this array of two objects) is not something we can reasonably support.
I'm not sure I understand your use case without additional context, but in the code you've shown, there's no comparison between the two countries, so I believe it could be implemented like this:
authorize(initial_country.country)
authorize(target_country)
@iggant or I guess maybe this?
# controller
def copy
authorize(initial_country.country, :allowed)
authorize(target_country, :allowed)
# ...
end
# policies/country_policy.rb
def allowed?
country_allowed?(record)
end
Without seeing the rest of your code, it's hard to tell what the best way to implement this is, but hopefully you get the idea.
Ruby, Rails and pundit versions
Ruby version: 3.0 Rails version: 6.1.4.1 Pundit version: master
How I am using
Observed behaviour
Inside
Admin::PublicationPolicy
I am getting record array (with namespace).Expected behaviour
Inside
Admin::PublicationPolicy
, I should able to getPost
object.