module PunditCustomErrors::Authorization

Module created to override Pundit’s ‘authorize’ function. It enables Pundit to use the ‘error_message’ attribute (if existent) inside a Policy object, displaying the given error message instead of a default error message.

Public Instance Methods

authorize(record, query = nil) click to toggle source
# File lib/pundit_custom_errors/authorization.rb, line 6
def authorize(record, query = nil)
  @_pundit_policy_authorized = true

  query ||= params[:action].to_s + '?'
  policy = policy(record)
  unless policy.public_send(query)
    fail generate_error_for(policy, query, record)
  end

  true
end

Protected Instance Methods

generate_error_for(policy, query, record) click to toggle source
# File lib/pundit_custom_errors/authorization.rb, line 20
def generate_error_for(policy, query, record)
  if policy.respond_to? :error_message
    message = policy.error_message
    policy.error_message = nil
  end

  message ||= translate_error_message_for_query(query, policy)
  message ||= "not allowed to #{query} this #{record}"

  error = Pundit::NotAuthorizedError.new(message)

  error.query, error.record, error.policy = query, record, policy
  error
end
translate_error_message_for_query(query, policy) click to toggle source
# File lib/pundit_custom_errors/authorization.rb, line 35
def translate_error_message_for_query(query, policy)
  t("#{policy.class.to_s.underscore}.#{query}",
    scope: 'pundit',
    default: :default) if self.respond_to?(:t)
end