What best practices testing in controller level with pundit?

[samnang]

What best practices testing in controller level with pundit?

[samnang]

Thank @thomasklemm, I end up creating a helper method to mock authorize method and stub out verify_authorized:

def mock_authorize(record, unauthorize: false)
  expectation = expect(controller).to receive(:authorize).with(record)
  expectation.and_raise(Pundit::NotAuthorizedError) if unauthorize

  allow(controller).to receive(:verify_authorized)
end

BTW, it's really a good trick to remove DoubleRenderError.

[thomasklemm]

How about testing the expected behavior (e.g. render template, redirect, set flash) depending on the stubbed result of the authorize call in your case? This should keep your isolation, and you can ensure your policies work correctly with policy specs (as you might already have done).

[thomasklemm]

Authorization influences the expected outcome of an HTTP request passing through a controller action, so I personally would choose not to stub the authorize @post out. E.g. for a staff user, an action should render a template, while an unauthorized user should be redirected back with a "You are not allowed to perform this action." flash.

[samnang]

I agree, but so far I face some issues in my project because most of my controller specs are doing insolation testing, so I don't touch models and heavy used on rspec double(test doubles), then pundit failed when it tried to resolve policy class.

[samnang]

I tried that approach by stubbing authorize method in different contexts, but it came to another issues when I use after_filter :verify_authorized in application_controller to ensure the authorize method has been called, then it's just failed and throw AbstractController::DoubleRenderError error.

[thomasklemm]

The after_filter :verify_authorized checks for the truthyness of @_policy_authorized, so you'd have to set this one, too.

The DoubleRenderError has been discussed before and could be fixed with code from #53.

class ApplicationController < ActionController::Base
  protect_from_forgery
  include Pundit

  rescue_from Pundit::NotAuthorizedError, with: :user_not_authorized

  private

  def user_not_authorized
    # Clear the previous response body to avoid a DoubleRenderError
    # when redirecting or rendering another view
    self.response_body = nil

    flash[:error] = "You are not authorized to perform this action."
    redirect_to request.headers["Referer"] || root_path
  end
end

[thomasklemm]

@samnang Glad to help. Thanks for reporting your solution.