Rails 5: permission for user to create record through permission table with Pundit

Question

In my app I have Permission table, which stores all the logic what User can do. With Pundit I want to allow User to create new Campaign if Permission table allows. User can access Campaigns and create new, if Permission table contains this info:

• permitable_type: Sysmodule // another table where I store info on System sections, where Campaigns is one of
• permitable_id: 2 // means Campaigns from Sysmodule
• level: 3 // means User can edit something in Campaigns section

So far I keep getting error "Pundit::NotDefinedError", unable to find policy of nil policies/application_policy.rb is standart, no changes. Obviously I am doing sothing wrong. How do I do this authorization correctly? Many thanks for any help! I am on Rails 5 + Pundit.

models/permission.rb

class Permission < ApplicationRecord
  belongs_to :permitable, polymorphic: true
  belongs_to :user
  enum level: {owner: 1, view: 2, edit: 3}
end

models/user.rb

has_many :permissions
has_many :campaigns, through: :permissions, source: :permitable, source_type: 'Campaign' do
  def owner_of
  where('`permissions`.`level` & ? > 0', Permission::owner )
  end
end

has_many :sysmodules, through: :permissions, source: :permitable, source_type: 'Sysmodule' do
  def can_access
  where('`permissions`.`level` & ? > 1', Permission::can_access )
  end
end

controllers/campaigns_controller.rb

def new
  @campaign = Campaign.new
  authorize @campaign
end

policies/campaign_policy.rb

class CampaignPolicy < ApplicationPolicy
attr_reader :user, :campaign, :permission
  @user = user
  @permission = permission
end
def new?
  user.permission? ({level: 3, permitable_type: "Sysmodule", permitable_id: 2})
end

views/campaigns/index.html.erb

<% if policy(@campaign).new? %>
</li>
   <li><%= link_to "New campaign", new_campaign_path(@campaign) %></li>
</li>
<% end %>

Answer 1

Instead of dealing directly with what permissions a user should have try thinking of it what roles users can have in a system.

This makes it much easier to create authorization rules that map to real world problems.

Lets imagine an example where we have users and groups. The rules are as follows:

• groups can be created by any user
• the user that creates the group automatically becomes an admin
• groups are private
• only admins or members can view a group
• only an admin can modify a group

The models:

class User < ApplicationRecord
  rolify 
end

class Group < ApplicationRecord
  resourcify
end

The policy:

class GroupsPolicy < ApplicationPolicy

  class Scope < Scope
    def resolve
      scope.with_roles([:admin, :member], current_user)
    end
  end

  def show?
    user.has_role?([:member, :admin], record)
  end

  def index?
    true
  end

  def create?
    true # any user can create
  end

  def new? 
   create?
  end

  def update?
    user.has_role?(:admin, record)
  end

  def edit?
    update?
  end

  def destroy?
    update?
  end
end

The controller

class GroupsController < ApplicationController

  respond_to :html

  before_action :autenticate!
  before_action :set_group!, only: [:show, :edit, :update, :destroy]

  def show
    respond_with(@group)
  end

  def index
    @groups = policy_scope(Group.all)
    respond_with(@groups)
  end

  def new
    @group = authorize( Group.new )
  end

  def create
    @group = authorize( Group.new(group_attributes) )
    if @group.save
      current_user.add_role(:member, @group)
      current_user.add_role(:admin, @group)
    end
    respond_with(@group)
  end

  def edit
  end

  def update
    @group.update(group_params)
    respond_with(@group)
  end

  def destroy
    @group.destroy
    respond_with(@group)
  end

  private 
    def set_group!
       @group = authorize( Group.find(params[:id]) )
    end

    def group_params
       params.require(:group).permit(:name)
    end
end