module Pundit::Authorization
Pundit
DSL to include in your controllers to provide authorization helpers.
@example
class ApplicationController < ActionController::Base include Pundit::Authorization end
@see pundit
@api public
Protected Instance Methods
Source
# File lib/pundit/authorization.rb, line 231 def permitted_attributes(record, action = action_name) policy = policy(record) method_name = if policy.respond_to?("permitted_attributes_for_#{action}") "permitted_attributes_for_#{action}" else "permitted_attributes" end pundit_params_for(record).permit(*policy.public_send(method_name)) end
Retrieves a set of permitted attributes from the policy.
Done by instantiating the policy class for the given record and calling ‘permitted_attributes` on it, or `permitted_attributes_for_{action}` if `action` is defined. It then infers what key the record should have in the params hash and retrieves the permitted attributes from the params hash under that key.
@see github.com/varvet/pundit#strong-parameters @param record [Object] the object we’re retrieving permitted attributes for @param action [Symbol, String] the name of the action being performed on the record (e.g. ‘:update`).
If omitted then this defaults to the Rails controller action name.
@return [Hash{String => Object}] the permitted attributes
Source
# File lib/pundit/authorization.rb, line 127 def policies @_pundit_policies ||= {} end
Cache of policies. You should not rely on this method.
@api private
Source
# File lib/pundit/authorization.rb, line 140 def policy(record) pundit.policy!(record) end
Retrieves the policy for the given record.
@see github.com/varvet/pundit#policies @param record [Object] the object we’re retrieving the policy for @return [Object] instance of policy class with query methods
Source
# File lib/pundit/authorization.rb, line 152 def policy_scope(scope, policy_scope_class: nil) @_pundit_policy_scoped = true policy_scope_class ? policy_scope_class.new(pundit_user, scope).resolve : pundit_policy_scope(scope) end
Retrieves the policy scope for the given record.
@see github.com/varvet/pundit#scopes @param scope [Object] the object we’re retrieving the policy scope for @param policy_scope_class [#resolve] the policy scope class we want to force use of @return [#resolve, nil] instance of scope class which can resolve to a scope
Source
# File lib/pundit/authorization.rb, line 193 def policy_scopes @_pundit_policy_scopes ||= {} end
Cache of policy scope. You should not rely on this method.
@api private
Source
# File lib/pundit/authorization.rb, line 33 def pundit @pundit ||= Pundit::Context.new( user: pundit_user, policy_cache: Pundit::CacheStore::LegacyStore.new(policies) ) end
An instance of {Pundit::Context} initialized with the current user.
@note this method is memoized and will return the same instance during the request. @api public @return [Pundit::Context] @see pundit_user
@see policies
Source
# File lib/pundit/authorization.rb, line 245 def pundit_params_for(record) params.require(PolicyFinder.new(record).param_key) end
Retrieves the params for the given record.
@param record [Object] the object we’re retrieving params for @return [ActionController::Parameters] the params
Source
# File lib/pundit/authorization.rb, line 169 def pundit_policy_scoped? !!@_pundit_policy_scoped end
@return [Boolean] wether or not policy scoping has been performed @see policy_scope
@see skip_policy_scope
Source
# File lib/pundit/authorization.rb, line 62 def pundit_reset! @pundit = nil @_pundit_policies = nil @_pundit_policy_scopes = nil @_pundit_policy_authorized = nil @_pundit_policy_scoped = nil end
Clears the cached Pundit
authorization data.
This method should be called when the pundit_user
is changed, such as during user switching, to ensure that stale authorization data is not used. Pundit
caches authorization policies and scopes for the pundit_user
, so calling this method will reset those caches and ensure that the next authorization checks are performed with the correct context for the new pundit_user.
@return [void]
Source
# File lib/pundit/authorization.rb, line 48 def pundit_user current_user end
Hook method which allows customizing which user is passed to policies and scopes initialized by {#authorize}, {#policy} and {#policy_scope}.
@note Make sure to call ‘pundit_reset!` if this changes during a request. @see github.com/varvet/pundit#customize-pundit-user @see pundit
@see pundit_reset!
@return [Object] the user object to be used with pundit
Source
# File lib/pundit/authorization.rb, line 162 def skip_policy_scope @_pundit_policy_scoped = :skipped end
Allow this action not to perform policy scoping.
@see github.com/varvet/pundit#ensuring-policies-and-scopes-are-used @return [void] @see verify_policy_scoped
Source
# File lib/pundit/authorization.rb, line 184 def verify_policy_scoped raise PolicyScopingNotPerformedError, self.class unless pundit_policy_scoped? end
Raises an error if policy scoping has not been performed.
Usually used as an ‘after_action` filter to prevent programmer error in forgetting to call {#policy_scope} or {#skip_policy_scope} in index actions.
@see github.com/varvet/pundit#ensuring-policies-and-scopes-are-used @raise [AuthorizationNotPerformedError] if policy scoping has not been performed @return [void] @see policy_scope
@see skip_policy_scope
Private Instance Methods
Source
# File lib/pundit/authorization.rb, line 209 def pundit_policy_scope(scope) policy_scopes[scope] ||= pundit.policy_scope!(scope) end
This was added to allow calling ‘policy_scope!` without flipping the `pundit_policy_scoped?` flag.
It’s used internally by ‘policy_scope`, as well as from the views when they call `policy_scope`. It works because views get their helper from {Pundit::Helper}.
@note This also memoizes the instance with ‘scope` as the key. @see Pundit::Helper#policy_scope
@api private