module DeadSimpleAuthorization::Helpers

Private Instance Methods

authorize(user, action, resource) click to toggle source

Check if a user can perform an action for a specific resource. If the user shouldn't have access to the resource, a NotAuthorizedErrror is raised.

Example: Is Bob allowed to view a Post ?

Assuming bob = User.new('bob'), post = Post.new('post title', 'post content')

authorize(bob, :view, post) will check for a PostPolicy by convention and will trigger the policy's view? method. In the PostPolicy's context, the user and post are available.

# File lib/dead_simple_authorization/helpers.rb, line 17
def authorize(user, action, resource)
  raise ::DeadSimpleAuthorization::Errors::NotAuthorized unless can?(user, action, resource)
end
can?(user, action, resource) click to toggle source

Check if a user can perform an action for a specific resource. This method is not as strict as authorize in a sense that it does not raise an error, but returns the boolean outcome of the check

# File lib/dead_simple_authorization/helpers.rb, line 26
def can?(user, action, resource)
  action = action.to_s
  policy_class = "#{resource.class}Policy"
  policy = Object::const_get(policy_class).new(resource, user)
  policy.send("#{action}?")
end