Basic pundit setup with OrderPolicy on create

- Needs to be integrated into a controller with `authorize @order` to be useful
rubyforgood · Jun 1, 2024 · e9429c9 · e9429c9
1 parent 2be7ed5
commit e9429c9
Show file tree

Hide file tree

Showing 3 changed files with 17 additions and 0 deletions.
diff --git a/Gemfile b/Gemfile
@@ -40,3 +40,5 @@ group :test do
   gem "capybara"
   gem "selenium-webdriver"
 end
+
+gem "pundit", "~> 2.3"
diff --git a/Gemfile.lock b/Gemfile.lock
@@ -214,6 +214,8 @@ GEM
     public_suffix (5.0.5)
     puma (6.4.2)
       nio4r (~> 2.0)
+    pundit (2.3.2)
+      activesupport (>= 3.0.0)
     racc (1.7.3)
     rack (3.0.10)
     rack-session (2.0.0)
@@ -380,6 +382,7 @@ DEPENDENCIES
   pg (~> 1.1)
   pry (~> 0.14.2)
   puma (>= 5.0)
+  pundit (~> 2.3)
   rails (~> 7.1.3, >= 7.1.3.2)
   selenium-webdriver
   shadcn-ui (~> 0.0.12)

diff --git a/app/policies/order_policy.rb b/app/policies/order_policy.rb
@@ -0,0 +1,12 @@
+class OrderPolicy
+  attr_reader :user, :order
+
+  def initialize(user, order)
+    @user = user
+    @order = order
+  end
+
+  def create?
+    user.portfolio == order.portfolio
+  end
+end