How do I pass extra context to Pundit scopes?

Question

I have a system where a User can be associated with many Portals, however a user's permissions may differ between portals.

For example, a user might be able to see unpublished posts in one portal, but not in another portal.

For methods like show?, I can grab the portal off the record.

def show?
  portal = record.portal
  # logic to check whether, for this particular portal, 
  # this user has permission to view this record
end

However that solution doesn't work for policy scopes.

Is there any way I can, say, pass in the portal to policy_scope method in the controller?

---

One solution I've seen around the place is to set a (temporary) attribute against the user, so that policy methods can use it. e.g.

# model
class User < ActiveRecord::Base
  attr_accessor :current_portal
  ...
end

# controller
posts = portal.posts
current_user.current_portal = current_portal
policy_scope posts

# policy Scope
def resolve
  portal = user.current_portal
  # logic to scope these records by user's portal permissions
end

However this seems like a workaround, and I can definitely think of other scenarios where I'd like to be able to give authorisation logic more context as well, and I don't want this workaround to become a bad habit.

Does anyone have any suggestions?

Answer 1

Pundit authorization classes are plain old ruby classes. Using pundit authorize method you can pass an object to be authorized and an optional query. When you for example use authorize method as

authorize @product, :update?

the authorize method will call the update? method on the ProductPolicy class. If no query passed, controller action name + ? mark will be set as the query. Take a look at Pundit authorize method definition.

So for passing extra parameters to Pundit authorize method, you should override authorize method with an extra argument:

module Pundit
  def authorize(record, query=nil, options=nil)
    query ||= params[:action].to_s + "?"

    @_pundit_policy_authorized = true

    policy = policy(record)

    if options.nil?
      raise NotAuthorizedError, query: query, record: record, policy: policy unless policy.public_send(query)
    else
      raise NotAuthorizedError, query: query, record: record, policy: policy unless policy.public_send(query, options)
    end
  end
end

Then in your policy class you could use this extra param

class ProductPolicy
  ...
  def update?(options)
    ...
  end

  def new?
    ...
  end
  ...
end

As you can see, you can have policy methods that accept an extra options argument.

Then you can use authorize method in your controllers in one of these ways:

authorize @product
authorize @product, nil, { owner: User.find(1) }
authorize @product, :some_method?, { owner: User.find(1) }
authorize @product, :some_method?