public access about action_policy HOT 4 CLOSED

I would do something like this:

# in controller
context = {current_user: current_user} # current_user is nil for guests

# in application_policy
class ApplicationPolicy < ActionPolicy::Base
   authorize :user, allow_nil: true

   # enable by default
   pre_check :deny_guests
   # define check but do not use it
   def deny_guests
     deny! if user.nil?
   end
end

# some policy class
class SomePolicy < ApplicationPolicy
  # disable the guest barrier for particular fields
  skip_pre_check :deny_guests, only: %I[list of public fields checks here]
end

So, we do not make everything publicly accessible but only explicit fields.

from action_policy.

Missing policy authorization context: user is the error I receive when a user is not auth'd

from action_policy.

The default base policy (ActionPolicy::Base) requires a user to be defined.
You can build your own ApplicationPolicy or override the authorize :user setting like this:

class ApplicationPolicy < ActionPolicy::Base
  authorize :user, allow_nil: true
end

NOTE: you still must pass user as the part of the authorization context (even if it's nil). Should work fine if your current_user (or similar) method returns nil for non-authenticated users.

Then, you can use pre-checks to provide public access to guests:

class ApplicationPolicy < ActionPolicy::Base
   authorize :user, allow_nil: true

   pre_check :allow_guests

   def allow_guests
     allow! if user.nil?
   end
end

from action_policy.

@palkan would you say this is a non-standard practice for authorization? in GraphQL how would you deal with this problem, e.g. Missing policy authorization context: user on fields that don't need a user.

from action_policy.