Testing authorization of not yet persisted records

[palkan]

Testing authorization of not yet persisted records

[palkan]

Looks like we do not recognize compound matchers in be_authorized_to. Will fix it.

[palkan]

You can use an_instance_of(Post) here.

Though I'd recommend to authorize! Post instead: authorization shouldn't depend on the input but on the action itself and a subject (which is missing in this case).

[louim]

Hey!
Thank you for the answer. While I agree that it's generally better to authorize! Post on initial create, in this case I need to authorize associations on the record that is being created. My policy looks somewhat like this:

class PostPolicy < ApplicationPolicy
  def create?
    allowed_to?(:update?, record.author) && other_conditions
  end
end

[louim]

subject(:create) { post :create, params: { post: post_payload } }
it "authorize the post do
  expect { create }.to be_authorized_to(:create?, an_instance_of(Post))
end

Maybe I spoke too soon, because passing an_instance_of(Post) result in the following message:

ActionPolicy::NotFound:
Couldn't find policy class for #<RSpec::Matchers::AliasedMatcher:0x00007ffcb7e13f28 @description_block=#<Proc:0x00007ffcbb0119f8@/Users/louim/.gem/ruby/2.6.5/gems/rspec-expectations-3.6.0/lib/rspec/matchers/dsl.rb:31 (lambda)>, @base_matcher=#<RSpec::Matchers::BuiltIn::BeAnInstanceOf:0x00007ffcb7e13f50 @expected=Post(some_attributes), @matcher_name=:an_instance_of>> (RSpec::Matchers::AliasedMatcher)

Because it can't infer the policy from the instance matcher, which make sense to me, so I tried:

subject(:create) { post :create, params: { post: post_payload } }
it "authorize the post do
  expect { create }.to be_authorized_to(:create?, an_instance_of(Post)).with(PostPolicy)
end

and I got

expected an instance of Post to be authorized with PostPolicy#create?, but the following calls were encountered:
        - #<Post id: 17439, some_more_post_attributes> was authorized with PostPolicy#create?

[louim]

Thanks!