Safeguard verify_authorized and controllers inheritance

[pjezusek]

Hello,

I have a problem with verify_authorized method when I'm using the inheritance in controllers. My project is divided into modules. Each module has a controller with some basic stuff and the rest controllers inherit from it. For example:

class SomeModuleController < ApplicationController
   after_action :verify_authorized

   before_action :authorize_access

   def authorize_access
      authorize :some_module, :access?
   end
end

class SomeModule::SomeController < SomeModuleController
   ...
   def show
      ....
      authorize @some, :show?
   end
   ...
end

And here comes the problem. When I run my tests I would like to also check if authorize @some, show? was not forgotten. But firstly I check (in the parent controller) if a user has an access to this module at all. In this way verify_authorized won't raise any error because there is always authorization in authorize_access method before any action.

I looked at the code and the only way for now which I see is to manage @_pundit_policy_authorized flag manually but maybe there is some 'official' way to achieve what I want.

Is there something I can do, to make this safeguard suitable for my architecture?

PS.: As this is my first question I would like to thank you for this great gem.

[Burgestrand]

Hi! I converted this to a Q&A for now, because I think the question is valid but I'm not sure it's within the scope of Pundit.

It's hard to tell how to ensure this in your case anyway, because it depends on which question you want to answer:

1. Have authorize been called at all?
2. Have authorize been called in this particular controller, i.e. not a parent?
3. Have authorize been called in this particular action, i.e. not an action filter?
4. Have authorize been called with the right record and/or the right query?

You could probably work your way around each and every one of these, but which one is important is dependent on your application. Pundit only provides no 1 out of the box.

4 might be very hard to determine automatically, and so it's all up to memory again, or your test suite if you will.