Is there a way to have a Pundit policy return false for all policies methods and override them all?

[jasper502]

Imagine a model is part of a tier on a subscription plan and then you can setup your views etc. accordingly vs having to add some sort of overriding call with an && in each method.

[Burgestrand]

Hi! I don't understand. Could you elaborate, or show some code?

[jasper502]

So here is a generic policy for a Project model:

class ProjectPolicy < ApplicationPolicy

  def index?
    account_user.admin? || account_user.member?
  end

  def show?
    account_user.admin? || account_user.member?
  end

  def create?
    account_user.admin? || account_user.member?
  end

  def update?
    account_user.admin? || account_user.member?
  end

  def destroy?
    record.issues.none? && (account_user.admin? || account_user.member?)
  end

  class Scope < Scope
    def resolve
      scope.all
    end
  end
end

Let's say Projects are a paid feature of the app and if you have a free account the current_account can return current_account.allow_projects? = false. In this case all of these policies would return false. I know I can add && current_account.allow_projects? to each but looking to add a single rule that would override them all on a policy by policy basis. I can then sprinkle authorization all over my views and then easily 'turn off' projects with a flick of a switch.

[Burgestrand]

Pundit is very light on purpose, so with the maintainer hat on I'm inclined to say that the solution for this is personal to your project and your requirements, and not something that Pundit is trying to solve.

A knee-jerk reaction is to, indeed, add && current_account.allow_projects? here. I don't necessarily see that as a bad thing, if nothing else it's very clear what is happening. If it's only for this policy then that doesn't feel like a big enough thing to throw more complicated solutions on.

Additionally it looks like your account_user.admin? || account_user.member? might be a thing worthy of it's own name. It's possibly incidental, but if those lines all mean the same then you could move those to a private method to clean it up.