pundit

Why are `scope`-oriented actions (particularly `index` actions) treated differently in Pundit?

由 会有一股神秘感。 提交于 2019-12-03 12:27:57
I am writing with respect to https://github.com/elabs/pundit#scopes I am under the impression that authorization should answer the question Are you allowed access to this resource? , i.e. a true / false answer. This is the case with all actions except index , which, according to Pundit's docs, should return different ActiveRecord::Relation 's depending on who is asking. For example, an admin gets scope.all , while a regular user gets scope.where(:published => true) . app/policies/post_policy.rb class Scope < Struct.new(:user, :scope) def resolve if user.admin? scope.all else scope.where(

Why is Pundit not coupled with Rolify like CanCanCan is?

由 泄露秘密 提交于 2019-12-03 09:36:55
问题 I am using Devise and interested in using Pundit but cannot find much on if it should be integrating with Rolify or if it is stand alone. CanCanCan works nicely with Rolify and I like the roles model. Am I missing a major reason why Pundit and Rolify do not seem to be used together a lot? 回答1: Why don't use them together? They can be easily used in a fashion like this class OrganisationPolicy def initialize(user, organisation) @user = user @organisation = organisation end def index? @user.has

Rails 4 - Pundit - create policy

由 前提是你 提交于 2019-12-02 16:36:47
问题 I'm trying to figure out how to use pundit in my Rails 4 app. I have a profile view in which I want to display a link to create a new project, subject to pundit authorisation. I have tried each of the following formulations: <%# if policy(Project.new).create? %> <%# if policy(Project).create? %> <%# if policy(@project).create? %> <%# if policy(Projects).create? %> <% if policy(project).create? %> <%= link_to 'CREATE A PROJECT', new_project_path, :class=>"btn btn-info" %> <% end %> The

Rails 4 - Pundit - create policy

由 ▼魔方 西西 提交于 2019-12-02 08:46:54
I'm trying to figure out how to use pundit in my Rails 4 app. I have a profile view in which I want to display a link to create a new project, subject to pundit authorisation. I have tried each of the following formulations: <%# if policy(Project.new).create? %> <%# if policy(Project).create? %> <%# if policy(@project).create? %> <%# if policy(Projects).create? %> <% if policy(project).create? %> <%= link_to 'CREATE A PROJECT', new_project_path, :class=>"btn btn-info" %> <% end %> The association between project and profile is: Project belongs_to :profile Profile has_many :projects, dependent:

Where is user.admin? defined in rails-devise-pundit starter app?

由 蹲街弑〆低调 提交于 2019-12-01 22:00:46
问题 I used RailsApps rails-composer to create a rails-devise-pundit starter application. I am still a little new to ruby on rails and newer to devise, pundit and rails 4. I was looking at the code to learn how it works. There are many places in controllers and in policy classes where user.admin? is called. But I can't find the admin? method. I would expect it to be in the User model but it isn't there. Here's the user class: class User < ActiveRecord::Base # Include default devise modules. Others

Rails 4 - Pundit - scoped policy for index

由 試著忘記壹切 提交于 2019-12-01 06:50:32
问题 I am trying to learn how to use Pundit with my Rails 4 app. I have the following models: class User < ActiveRecord::Base has_one :profile has_many :eois end class Profile < ActiveRecord::Base belongs_to :user has_many :projects, dependent: :destroy end class Project < ActiveRecord::Base belongs_to :profile has_many :eois end class Eoi < ActiveRecord::Base belongs_to :project belongs_to :user end I have a scoped EoiPolicy with: class EoiPolicy < ApplicationPolicy class Scope attr_reader :user,

How to get Active Admin to work with Pundit after login

由 谁说胖子不能爱 提交于 2019-12-01 06:07:06
I've added the configuration pundit addapter authorization to my application config.authorization_adapter = ActiveAdmin::PunditAdapter When I login with the admin@example.com credentials I'm getting this error. Pundit::NotDefinedError in Admin::Dashboard#index unable to find policy AdminUserPolicy Extracted source (around line #2): insert_tag active_admin_application.view_factory["page"] so I created these files in my policies/active_admin folder adminuser_policy.rb module ActiveAdmin class AdminUserPolicy < ApplicationPolicy class Scope < Struct.new(:user, :scope) def resolve scope end end

Pundit policy_scope error: undefined method `admin?' for nil:NilClass

由 孤者浪人 提交于 2019-11-29 16:17:59
Running into something I don't understand with Pundit, Using Rails 4.2.5.1, Pundit 1.1.0 with Devise for authentication. I'm trying to use a policy scope for the BlogController#Index action. If user is admin, display all posts (drafts, published) If user is standard, display posts marked published only If no user / user not logged in, display posts marked published only Getting an error: undefined method `admin?' for nil:NilClass Live shell reveals: >> user => nil # ApplicationController class ApplicationController < ActionController::Base include Pundit rescue_from Pundit::NotAuthorizedError,

rails leaving out some parts from fragment caching

由 爱⌒轻易说出口 提交于 2019-11-29 16:02:28
I have a rails 4 app using pundit gem for authorization. If I do russian-doll fragment caching like the code below, the conditional statement used for authorization will be also cached, which is not good, since edit/delete buttons should only be available for the post.user . What is the good way to get around this? Should I split the cache into smaller parts or is there a way to exclude some parts of the caching? What's the rails convention in this case? index.html.erb <% cache ["posts-index", @posts.map(&:id), @posts.map(&:updated_at).max, @posts.map {|post| post.user.profile.updated_at}.max]

rails leaving out some parts from fragment caching

由 …衆ロ難τιáo~ 提交于 2019-11-28 09:33:35
问题 I have a rails 4 app using pundit gem for authorization. If I do russian-doll fragment caching like the code below, the conditional statement used for authorization will be also cached, which is not good, since edit/delete buttons should only be available for the post.user . What is the good way to get around this? Should I split the cache into smaller parts or is there a way to exclude some parts of the caching? What's the rails convention in this case? index.html.erb <% cache ["posts-index"
订阅 pundit