Authorization: Pundit
Pundit is a Ruby authorization gem that this app never installed. The course reads Pundit's conventions from its GitHub README: one policy class per model, initialize(user, record), question-mark permission methods and an ApplicationPolicy base. It then covers the controller helpers authorize and policy_scope and the shared Pundit::NotAuthorizedError rescue. Next it reads the policies this app built by hand, the other files in app/policies/, and how their shape compares with Pundit's. It closes with the costs and benefits of adopting the gem and a small Ruby challenge.
What you'll learn
- ✓Pundit's naming convention, policy class shape and ApplicationPolicy base
- ✓How authorize, policy_scope and the Pundit::NotAuthorizedError rescue work in controllers
- ✓How this app's hand-built access-control policies are written and called
- ✓The difference between access-control policies and domain-rule policies in app/policies/
- ✓What adopting Pundit would cost and change, including the policy_class: option
Pundit's conventions, from its own docs: a policy class per model
Pundit is a widely used Ruby authorization gem, over a decade old and still maintained. This app's Gemfile and Gemfile.lock have no pundit line; the app never installed it. Before comparing anything, this course reads Pundit's conventions from its GitHub README (github.com/varvet/pundit), the way…
Read the full lesson free →Curriculum
7 lessonsPundit's conventions, from its own docs: a policy class per model
Reads Pundit's README conventions: one policy class per model, a two-argument initialize, and the generated ApplicationPolicy base.
Pundit's controller integration: authorize, policy_scope and NotAuthorizedError
Covers authorize, the shared Pundit::NotAuthorizedError rescue, policy_scope with a nested Scope class, and verify_authorized for development.
This app never installed Pundit; it built its own access-control policies
Reads Identity::UserPolicy and Community::CommentPolicy, hand-built access-control policies called by name from controllers, a service and a view.
Two more files named Policy, and the folder around them
Examines StreakPolicy and SolutionAccessPolicy as domain-rule class methods, plus Partners::Tiers and the other files in app/policies/.
The convergent shape: this app's policies already look like Pundit's
Compares this app's policies with Pundit's shape and names three missing pieces: authorize, a shared rescue and policy_scope.
What adopting Pundit would change, and a naming mismatch in this app
Shows the naming mismatch in Identity::UserPolicy, Pundit's policy_class: option, and the costs and benefits of adopting the gem.
Putting it together: a well-known shape, reached without the gem
Reviews the course's model in order and ends with a pure Ruby challenge combining submit_execution? and destroy? logic.