Authorization with Pundit for Rails 8

Overview

Pundit provides policy-based authorization:

• Plain Ruby policy objects
• Convention over configuration
• Easy to test with Minitest
• Scoped queries for collections
• Works with any authentication system

Quick Start

bundle add pundit
bin/rails generate pundit:install
bin/rails generate pundit:policy Event

TDD Workflow

Authorization Progress:
- [ ] Step 1: Write policy test (RED)
- [ ] Step 2: Run test (fails)
- [ ] Step 3: Implement policy
- [ ] Step 4: Run test (GREEN)
- [ ] Step 5: Add policy to controller
- [ ] Step 6: Test integration

Base Policy

# app/policies/application_policy.rb
class ApplicationPolicy
  attr_reader :user, :record

  def initialize(user, record)
    @user = user
    @record = record
  end

  def index?
    false
  end

  def show?
    false
  end

  def create?
    false
  end

  def new?
    create?
  end

  def update?
    false
  end

  def edit?
    update?
  end

  def destroy?
    false
  end

  class Scope
    def initialize(user, scope)
      @user = user
      @scope = scope
    end

    def resolve
      raise NotImplementedError, "Define #resolve in #{self.class}"
    end

    private

    attr_reader :user, :scope
  end
end

Policy Testing (Minitest)

Basic Policy Test

# test/policies/event_policy_test.rb
require "test_helper"

class EventPolicyTest < ActiveSupport::TestCase
  setup do
    @account = accounts(:one)
    @user = users(:one) # belongs to @account
    @other_user = users(:other_account) # different account
    @event = events(:one) # belongs to @account
  end

  # -- index --
  test "index? permits any authenticated user" do
    policy = EventPolicy.new(@user, Event)
    assert policy.index?
  end

  # -- show --
  test "show? permits user from same account" do
    policy = EventPolicy.new(@user, @event)
    assert policy.show?
  end

  test "show? denies user from different account" do
    policy = EventPolicy.new(@other_user, @event)
    assert_not policy.show?
  end

  # -- create --
  test "create? permits user from same account" do
    new_event = Event.new(account: @account)
    policy = EventPolicy.new(@user, new_event)
    assert policy.create?
  end

  # -- update --
  test "update? permits user from same account" do
    policy = EventPolicy.new(@user, @event)
    assert policy.update?
  end

  test "update? denies user from different account" do
    policy = EventPolicy.new(@other_user, @event)
    assert_not policy.update?
  end

  # -- destroy --
  test "destroy? permits user from same account" do
    policy = EventPolicy.new(@user, @event)
    assert policy.destroy?
  end

  test "destroy? denies user from different account" do
    policy = EventPolicy.new(@other_user, @event)
    assert_not policy.destroy?
  end

  # -- Scope --
  test "Scope returns events for user account only" do
    scope = EventPolicy::Scope.new(@user, Event).resolve

    scope.each do |event|
      assert_equal @user.account_id, event.account_id
    end
  end

  test "Scope excludes other account events" do
    other_event = events(:other_account)
    scope = EventPolicy::Scope.new(@user, Event).resolve

    assert_not_includes scope, other_event
  end
end

Role-Based Policy Test

# test/policies/event_policy_test.rb (role-based extension)
class EventPolicyRoleTest < ActiveSupport::TestCase
  setup do
    @admin = users(:admin)
    @member = users(:one)
    @event = events(:one)
  end

  test "destroy? permits admin" do
    policy = EventPolicy.new(@admin, @event)
    assert policy.destroy?
  end

  test "publish? permits owner for draft events" do
    @event.update(status: :draft)
    policy = EventPolicy.new(@member, @event)
    assert policy.publish?
  end

  test "publish? denies for non-draft events" do
    @event.update(status: :published)
    policy = EventPolicy.new(@member, @event)
    assert_not policy.publish?
  end
end

Policy Implementation

Basic Policy (Account-Scoped)

# app/policies/event_policy.rb
class EventPolicy < ApplicationPolicy
  def index?
    true
  end

  def show?
    owner?
  end

  def create?
    true
  end

  def update?
    owner?
  end

  def destroy?
    owner?
  end

  private

  def owner?
    record.account_id == user.account_id
  end

  class Scope < ApplicationPolicy::Scope
    def resolve
      scope.where(account_id: user.account_id)
    end
  end
end

Role-Based Policy

# app/policies/event_policy.rb
class EventPolicy < ApplicationPolicy
  def index?
    true
  end

  def show?
    owner? || admin?
  end

  def create?
    member_or_above?
  end

  def update?
    owner_or_admin?
  end

  def destroy?
    admin?
  end

  def publish?
    owner_or_admin? && record.draft?
  end

  private

  def owner?
    record.account_id == user.account_id
  end

  def admin?
    user.admin?
  end

  def member_or_above?
    user.member? || user.admin?
  end

  def owner_or_admin?
    owner? || admin?
  end

  class Scope < ApplicationPolicy::Scope
    def resolve
      if user.admin?
        scope.all
      else
        scope.where(account_id: user.account_id)
      end
    end
  end
end

Controller Integration

# app/controllers/events_controller.rb
class EventsController < ApplicationController
  def index
    @events = policy_scope(Event)
  end

  def show
    @event = Event.find(params[:id])
    authorize @event
  end

  def create
    @event = current_account.events.build(event_params)
    authorize @event

    if @event.save
      redirect_to @event, notice: t(".success")
    else
      render :new, status: :unprocessable_entity
    end
  end

  def destroy
    @event = Event.find(params[:id])
    authorize @event
    @event.destroy
    redirect_to events_path, notice: t(".success")
  end
end

Ensuring Authorization

# app/controllers/application_controller.rb
class ApplicationController < ActionController::Base
  include Pundit::Authorization

  after_action :verify_authorized, except: :index
  after_action :verify_policy_scoped, only: :index

  rescue_from Pundit::NotAuthorizedError, with: :user_not_authorized

  private

  def user_not_authorized
    flash[:alert] = t("pundit.not_authorized")
    redirect_back(fallback_location: root_path)
  end
end

Testing Controller Authorization

# test/controllers/events_controller_test.rb
require "test_helper"

class EventsControllerTest < ActionDispatch::IntegrationTest
  setup do
    @user = users(:one)
    @other_user = users(:other_account)
    @event = events(:one) # belongs to @user's account
    @other_event = events(:other_account)
    sign_in @user
  end

  test "allows access to own events" do
    get event_path(@event)
    assert_response :success
  end

  test "denies access to other account events" do
    get event_path(@other_event)
    assert_redirected_to root_path
  end

  test "allows deletion of own events" do
    assert_difference("Event.count", -1) do
      delete event_path(@event)
    end
    assert_redirected_to events_path
  end

  test "denies deletion of other account events" do
    assert_no_difference("Event.count") do
      delete event_path(@other_event)
    end
    assert_redirected_to root_path
  end
end

View Integration

<%# app/views/events/show.html.erb %>
<h1><%= @event.name %></h1>

<% if policy(@event).edit? %>
  <%= link_to t("common.edit"), edit_event_path(@event) %>
<% end %>

<% if policy(@event).destroy? %>
  <%= button_to t("common.delete"), @event, method: :delete,
                data: { confirm: t("common.confirm_delete") } %>
<% end %>

Headless Policies

For actions not tied to a specific record:

# app/policies/dashboard_policy.rb
class DashboardPolicy < ApplicationPolicy
  def initialize(user, _record = nil)
    @user = user
  end

  def show?
    true
  end

  def admin_panel?
    user.admin?
  end
end

# Controller
authorize :dashboard, :admin_panel?

Error Messages

# config/locales/en.yml
en:
  pundit:
    not_authorized: You are not authorized to perform this action.

Checklist

• Policy test written first (RED)
• Policy inherits from ApplicationPolicy
• Scope defined for collections
• Controller uses authorize and policy_scope
• verify_authorized after_action enabled
• Views use policy(@record).action?
• Error handling configured
• Multi-tenancy enforced in Scope
• All tests GREEN