Stack Overflow
Stack Overflow

Questions tagged [pundit]

Pundit provides a set of helpers that guide Ruby programmer in leveraging regular Ruby classes and object oriented design patterns to build a simple, robust and scaleable authorization system.

439 questions
20
votes
2 answers

How to use pundit scopes?

I have just made the switch to Pundit from CanCan. I am unsure about a couple of things, and how Pundit is best used. For example: If you have a resource that can have multiple parent objects, for instance lets say a Goal belongs to a student and…
hellion
  • 4,602
  • 6
  • 38
  • 77
15
votes
1 answer

Pundit::AuthorizationNotPerformedError in Rails

What might be causing this error in verify_authorized method and how to fix it?
Basti B.
  • 371
  • 2
  • 6
  • 17
14
votes
4 answers

Pundit policies with two input parameters

I'm pretty new with Rails and I have a problem with the following policies (using Pundit): I'd like to compare two objects: @record and @foo, as you can see here: class BarPolicy < ApplicationPolicy def show? @record.foo_id == @foo …
Rowandish
  • 2,655
  • 3
  • 31
  • 52
14
votes
4 answers

Using Pundit with namespace

In my project, i have pretty common namespace "admin". namespace :admin do resources :users, except: :show end I use Pundit gem to set proper authorization, but i found it difficult to use with controllers within namespace. my policies are…
Leo
  • 2,061
  • 4
  • 30
  • 58
13
votes
3 answers

Rails 4 with Pundit & Statesman gem - policy when an object is in a state

I am trying to make an app in Rails 4. I am trying to use statesman gem for states and then pundit for policies. My gemfile has: gem 'statesman', '~> 1.3', '>= 1.3.1' gem 'pundit' I have an article model and an article transitions model and an…
Mel
  • 2,481
  • 26
  • 113
  • 273
13
votes
2 answers

Pundit authorisation using service objects

The Tools Pundit Authorisation; experimenting with this pull request linked to from the official Pundit README; ActiveInteraction domain service objects ("DSOs"); RSpec 2.99.1 ** The Project** The project repo is on Github; what's under scrutiny…
Jeff Dickey
  • 1,071
  • 11
  • 21
13
votes
4 answers

How to test Pundit policies with Minitest?

Gemfile gem 'pundit', '~> 0.2.1' app/controllers/application_controller.rb class ApplicationController < ActionController::Base include Pundit ... app/policies/application_policy.rb class ApplicationPolicy < Struct.new(:user, :record) def…
user664833
  • 18,397
  • 19
  • 91
  • 140
11
votes
2 answers

Pundit authorization in index

I have been recently reading through the pundit gem's README and noticed that they never authorize the index view within a controller. (Instead they use scope). They give good reasoning for this, as an index page generally contains a list of…
Lilith Daemon
  • 1,473
  • 1
  • 19
  • 37
11
votes
1 answer

Accessing session parameters in Pundit policy

It appears that Pundit policy does not access session parameters. As constructs does not reconize session as a valid variable or method. Is there any way to access session or other params? class MyModelPolicy def create? @contructs =…
Jerome
  • 5,583
  • 3
  • 33
  • 76
10
votes
2 answers

Why is Pundit not coupled with Rolify like CanCanCan is?

I am using Devise and interested in using Pundit but cannot find much on if it should be integrating with Rolify or if it is stand alone. CanCanCan works nicely with Rolify and I like the roles model. Am I missing a major reason why Pundit and…
MicFin
  • 2,431
  • 4
  • 32
  • 59
10
votes
1 answer

Why are `scope`-oriented actions (particularly `index` actions) treated differently in Pundit?

I am writing with respect to https://github.com/elabs/pundit#scopes I am under the impression that authorization should answer the question Are you allowed access to this resource?, i.e. a true/false answer. This is the case with all actions except…
user664833
  • 18,397
  • 19
  • 91
  • 140
9
votes
1 answer

Rubocop RSpec/MultipleMemoizedHelpers issue on pundit spec tests

I use pundit for authorization and RSpec for testing in my rails app. Due to this, I had to create specs for the policies. However, I am having a problem with rubocop throwing an error: RSpec/MultipleMemoizedHelpers. I understand that this means I…
Shania
  • 244
  • 2
  • 9
9
votes
2 answers

skip authorization for specific controllers using pundit in rails 4

I am using rails 4, devise for authentication and Pundit for authorization. I have restricted my application to check for authorization on every controller by below code. class ApplicationController < ActionController::Base include Pundit …
Vijay Meena
  • 683
  • 1
  • 7
  • 12
9
votes
1 answer

Pundit authorization on activeadmin custom page

In a Rails 4 app with activeadmin gem (current master branch) I use Pundit for authorization. It works well for ressources but I don't manage to make it work for pages. Given for example : ActiveAdmin.register_page "Home" do content do …
Alex
  • 103
  • 5
9
votes
6 answers

Pundit Headless Policy

I'm using pundit for access control in the admin section of my app. I have a dashboards controller that looks like this: class Admin::DashboardsController < AdminController def index @total_revenue = Order.total_revenue authorize…
Edward Loveall
  • 1,983
  • 1
  • 19
  • 34
1
2 3
…
29 30