Pundit: Why does #authorize return true?

[lnikkila]

Hey there! I love the library, but this got me thinking.

Why does #authorize return true? If it raises an error, there’s really no use checking whether its return value is truthy.

If it returned the record that was passed into it, it could be used for one-liners like this:

render json: authorize(Foo.all)

[jnicklas]

I don't think there was any real intention behind returning true besides it seeming sane.

Please be aware that the example you posted probably doesn't work as you expect. Passing a scope to authorize will pass the entire scope to the policy, not authorize each record in the scope individually. See more thorough explanation.

One could make a point that forcing authorize to stand on its own would make it more explicit, but I'm not sure that I buy my own argument in this case.

Nevertheless, you're just a little late to the party. Had you come with this issue literally earlier the same day that you reported it, we could have considered it, but unfortunately this is a backwards compatibility breaking change, and we have _just_ cut Pundit 1.0. Given semver, we can't consider this change before 2.0. Given Pundit's simplicity, I am doubtful that a 2.0 is going to happen for a really long time, if ever.

[lnikkila]

Yeah that timing was pretty unfortunate. I understand your reasoning completely.

I resorted to overriding the method in my ApplicationController:

def authorize(record, query = nil)
  record if super(record, query)
end

And about the scopes: I’m handling those cases in my policies so that it works.

Anyway, thanks for giving it a thought! :+1:

[jnicklas]

Closing this since we won't tackle it for the foreseeable future.

[lukeredpath]

Looks like this has been changed after all:

https://github.com/elabs/pundit/commit/21d4c1bd2d0a2d69b8c32653870cd63bf0ca0eae

Was a bit confused as this is only changed on master and I was wondering why the latest release wasn't behaving as documented in the master README!

[jnicklas]

Yes, master will be released as 2.0 at some point.