Policy actions for model association managed through nested resource controller about action_policy HOT 1 CLOSED

Saw your AnyCable presentation at Ruby Kaigi in Sendai and thought it was one of the best presentations. ;)

Thanks! Glad you liked it)

I think this was because I defined manage?

Yep. manage? is the default rule for ActionPolicy::Base. You can change this behaviour either by not using ActionPolicy::Base as your root policy (see https://actionpolicy.evilmartians.io/#/custom_policy) or by setting default_rule nil.

This means index_readers?, create_readers? and count_readers?

Do these three actions require different permissions?

Usually, when dealing with associations I use some basic rule for the parent model instead of defining custom, e.g.: if I can see the post, I can see the readers and count them => call authorize! post, to: :show? in #index_readers and #count_readers.

That would also provide a meaningful failure reason (if you use i18n integration), e.g. "You don't have enough permissions to see this post".

There is no generic solution though, it highly depends on the business logic of your authorization model.

from action_policy.