varvet / pundit

Minimal authorization through OO design and pure Ruby classes
MIT License
8.27k stars 629 forks source link

Helper policy_scope does not accept policy_scope_class #790

Closed matthewjsummers closed 6 months ago

matthewjsummers commented 11 months ago

When using policy_scope from a controller, it's possible to define the policy_scope_class using the policy_scope_class: argument.

The Helper method added to views:

  module Helper
    def policy_scope(scope)
      pundit_policy_scope(scope)
    end
  end

doesn't call this same method, but instead directly calls pundit_policy_scope which doesn't permit the policy_scope_class.

Is there a reason? it's not intuitive that there are two different behaviours to the policy_scope function and this does mean that you can't call policy_scope from views with a policy_scope_class.

Burgestrand commented 6 months ago

Hm, well the policy_scope_class: was added in https://github.com/varvet/pundit/pull/441 while the helper was added in https://github.com/varvet/pundit/pull/262

I can't parse a reason from out of this.

If I may be so bold to provide an opinion here then I'd say that querying models from the views in this fashion (effectively e.g. Model.all.some.query.filtering) is usually not a good idea. Most often the queries are set up in the controller (e.g. @posts = policy_scope(...)), and then you render the views to iterate over the results and display their data.

I'll close this for now, mostly because I'm not convinced of a use-case for this right now. I do appreciate the question coming up, though.