varvet/pundit

Overriding both authorize and policy is required for namespacing

Open

#723 opened on Feb 20, 2022

View on GitHub
 (4 comments) (1 reaction) (0 assignees)Ruby (643 forks)batch import
good first issue

Repository metrics

Stars
 (8,501 stars)
PR merge metrics
 (No merged PRs in 30d)

Description

The README explains how to namespace policies, however this does not seem to take into account direct calls to policy (e.g. calling policy(record).show? from some view). Before the merge of #697, it was possible to only override policy and authorize would automatically be properly scoped as well. Now it has apparently become necessary to override both authorize and policy in Pundit::Authorization. It still works, but is just now more cumbersome, and also required some figuring out when performing the upgrade to Pundit 2.2.0.

Opening this issue as suggested in #697.

Contributor guide

Research direction
Inspect PR #697 and trace how `authorize` and `policy` methods are overridden. Identify the missing delegation in the namespacing logic and propose a fix that restores automatic scoping.
Tech stack
ruby
Domain
backend
Issue type
Bug
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
Ruby
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
50