Class: TransitionButtons::Authorizers::ActionPolicy

Inherits:
Object
  • Object
show all
Defined in:
lib/transition_buttons/authorizers/action_policy.rb

Overview

Authorizer backed by ActionPolicy.

Convention: a transition event maps to the policy rule of the same name with a ? suffix (event :publish -> rule publish?). When the policy defines no such rule we deny by default, so adding an event without a matching rule can never silently expose it.

Instance Method Summary collapse

Instance Method Details

#permitted?(user:, record:, event:, machine:) ⇒ Boolean

Returns:

  • (Boolean) 


10
11
12
13
14
15
16
 
# File 'lib/transition_buttons/authorizers/action_policy.rb', line 10

def permitted?(user:, record:, event:, machine:)
  policy = ::ActionPolicy.lookup(record).new(record, user: user)
  rule = :"#{event}?"
  return false unless policy.respond_to?(rule)

  policy.apply(rule)
end