Mocking Policy Actions

[cgmcintyr]

Hi,

I've been using action_policy in a number of projects at work, and have struggled with how best to set up tests where a user's authorization is mocked out.

A specific issue: I have used allowed_to? to define what parts of a page are rendered (e.g. links to #new paths). When writing rspec examples I don't want to go through setting up a user with the correct granular abilities for each system test. Instead, I would like to use a helper function that mocks out policies/actions:

describe '#show' do
  let!(:subject) { create(:collection) }

  context 'signed in as a user with authorization to show collection, and create items' do
    before(:each) do
      ...
    end

    around(:each) do |example|
      authorized_to([
        [:show?, record: subject],
        [:new?, with: ItemPolicy],
        [:create?, with: ItemPolicy],
      ]) do
        # all calls to #show? on instances of CollectionPolicy where the record is the subject, regardless of user, should return true
        # all calls to #new? and #create? on instances of ItemPolicy, regardless of user or record, should return true
        example.run
      end
    end

    it 'has a link to create new item' do
      ...
    end
  end
end

Is this a feature that could be added to action_policy? If not, would I be able to get advice on which functions to mock out to achieve this? I have some working code at the moment, but it feels brittle as heck!

[palkan]

Yes, that would be a good addition (actually, it's on my private TODO list for Action Policy).

In one project, I used the following API:

it "is allowed" do
  stub_policy(PlaygroundPolicy).to allow_rule(:manage_api?).for(playground)
  expect(subject).to eq playground
 end

it "is not allowed" do
   stub_policy(PlaygroundPolicy).to deny_rule(:manage_api?).for(playground)

   expect { subject }.to raise_error(PermissionError)
end

And this is the implementation:

# frozen_string_literal: true

module PolicyHelpers
  class Stub
    attr_reader :policy, :example

    def initialize(policy, example)
      @policy = policy
      @example = example
    end

    def to(matcher)
      # Pass policy as local var to the block
      policy = self.policy

      example.instance_exec do
        allow_any_instance_of(policy).to receive(matcher.rule) do |instance|
          expect(instance).to matcher
          matcher.value
        end
      end
    end
  end

  class Matcher < RSpec::Matchers::BuiltIn::HaveAttributes
    attr_reader :rule, :value

    def initialize(rule, value)
      @rule = rule
      @value = value
      super({})
    end

    def for(record)
      @expected[:record] = record
      self
    end
  end

  def stub_policy(policy_class)
    Stub.new(policy_class, self)
  end

  def allow_rule(rule)
    Matcher.new(rule, true)
  end

  def deny_rule(rule)
    Matcher.new(rule, false)
  end
end

RSpec.configure do |config|
  config.include PolicyHelpers
end

The reason why it has never been upstreamed is that I had to use allow_any_instance_of—not really good(

I hadn't had time to find a better way of handling this though.

[cgmcintyr]

I've had a go at an implementation that does not use allow_any_instance_of. It is a bit messy but hopefully can serve as a starting point. I've had to tweak the API to avoid overwriting the new mock when stubbing multiple rules:

API Example

describe CollectionPolicy, type: :policy do
  let(:user) { create(:user) }
  let(:collection) { create(:collection) }
  let(:other_collection) { create(:collection) }

  it 'can be stubbed true for a single record' do
    stub_policy(CollectionPolicy).to allow_rule(:create?).for(collection)
    expect(CollectionPolicy.new(collection, user: user).create?).to be(true)
    expect(CollectionPolicy.new(other_collection, user: user).create?).to be(false)
  end

  it 'can be stubbed false for a single record' do
    stub_policy(CollectionPolicy).to deny_rule(:create?).for(collection)
    expect(CollectionPolicy.new(collection, user: user).create?).to be(false)
    expect(CollectionPolicy.new(other_collection, user: user).create?).to be(false)
  end

  it 'can stub for all calls to a rule' do
    stub_policy(CollectionPolicy).to allow_rule(:create?)
    expect(CollectionPolicy.new(collection, user: user).create?).to be(true)
    expect(CollectionPolicy.new(other_collection, user: user).create?).to be(true)
  end

  it 'can stub different rules with different results for a single record' do
    stub_policy(CollectionPolicy).to [
      allow_rule(:create?).for(collection),
      allow_rule(:update?).for(collection),
      deny_rule(:destroy?).for(collection)
    ]
    expect(CollectionPolicy.new(collection, user: user).create?).to be(true)
    expect(CollectionPolicy.new(collection, user: user).update?).to be(true)
    expect(CollectionPolicy.new(collection, user: user).destroy?).to be(false)
  end

  it 'can stub different rules a single record as well as global rules' do
    stub_policy(CollectionPolicy).to [
      allow_rule(:create?),
      allow_rule(:update?).for(collection)
    ]
    expect(CollectionPolicy.new(collection, user: user).create?).to be(true)
    expect(CollectionPolicy.new(other_collection, user: user).create?).to be(true)

    expect(CollectionPolicy.new(collection, user: user).update?).to be(true)
    expect(CollectionPolicy.new(other_collection, user: user).update?).to be(false)
  end
end

Implementation

module Policy
  class Stub
    attr_reader :policy, :example

    def initialize(policy, example)
      @policy = policy
      @example = example
    end

    def to(matchers)
      matchers = [matchers] unless matchers.is_a? Enumerable

      # Pass policy as local var to the block
      policy = self.policy

      example.instance_exec do
        allow(policy).to receive(:new).and_wrap_original do |m, *args|
          instance = m.call(*args)
          record = args.first

          global_matchers = matchers.reject(&:record)
          global_rules = global_matchers.map(&:rule)

          specific_matchers = matchers.select(&:record).reject { |matcher| global_rules.include? matcher.rule }
          specific_matchers_by_rule = specific_matchers.inject({}) do |h, matcher|
            (h[matcher.rule] ||= [])
            h[matcher.rule] << matcher
            h
          end

          global_matchers.each do |matcher|
            expect(instance).to matcher
            allow(instance).to receive(matcher.rule).and_return matcher.value
          end

          specific_matchers_by_rule.each do |rule, rule_matchers|
            matcher_for_record = rule_matchers.find { |matcher| matcher.record == instance.record }
            if matcher_for_record
              expect(instance).to matcher_for_record
              allow(instance).to receive(rule).and_return matcher_for_record.value
              allow(instance).to receive(:allowed_to?).with(rule, record, any_args).and_return matcher_for_record.value
            else
              allow(instance).to receive(rule).and_call_original
              allow(instance).to receive(:allowed_to?).and_call_original
            end
          end

          instance
        end
      end
    end
  end

  class Matcher < RSpec::Matchers::BuiltIn::RespondTo
    attr_reader :rule, :value, :record

    def initialize(rule, value)
      @rule = rule
      @value = value
      super(rule)
    end

    def for(record)
      @record = record
      self
    end
  end

  def stub_policy(policy_class)
    Stub.new(policy_class, self)
  end

  def allow_rule(rule)
    Matcher.new(rule, true)
  end

  def deny_rule(rule)
    Matcher.new(rule, false)
  end
end

[palkan]

What about chaining?

stub_policy(CollectionPolicy).to allow_rule(:create?)
  .and allow_rule(:update?).for(collection)

[palkan]

Regarding the implementation, I have only one concern: how easy it will be to do the same for Minitest?

I was thinking about using our existing caching tools for this: memoized behaviour and cached apply for policies.
For example, per-thread memoization could be used to predefine the policy instance for the record. Then, we can use a cached apply to prerecord the result for apply! calls. WDYT?

[cgmcintyr]

What about chaining?

stub_policy(CollectionPolicy).to allow_rule(:create?)
  .and allow_rule(:update?).for(collection)

Chaining could work, if and built up an enumerable. The reason I pass an enumerable is due to my implementation using allow(policy).to receive(:new).and_wrap_original. The benefit of this is we avoid using allow_any_instance_of, the drawback is we have to stub out every method at once as we are dynamically stubbing out those methods on initialization of the policy.

One way I could think of adding and:

class MatcherArray < Array
  def and(matcher)
    unless matcher.is_a? Enumerable
      self << matcher
    else
      self + matcher
    end
  end
end

class Matcher < RSpec::Matchers::BuiltIn::RespondTo
  attr_reader :rule, :value, :record

  def initialize(rule, value)
    @rule = rule
    @value = value
    super(rule)
  end

  def for(record)
    @record = record
    self
  end

  def and(matcher)
    arr = MatcherArray.new()
    arr.and(self).and(matcher)
  end
end

[cgmcintyr]

Regarding the implementation, I have only one concern: how easy it will be to do the same for Minitest?

I am unfamiliar with minitest, to be honest.

I was thinking about using our existing caching tools for this: memoized behaviour and cached apply for policies.
For example, per-thread memoization could be used to predefine the policy instance for the record. Then, we can use a cached apply to prerecord the result for apply! calls. WDYT?

I think having a predefined policy instance would be a vast improvement on my implementation. My implementation will re-run the stubbing code on every instantiation of that policy, whereas having a single instance with cached results for apply sounds a lot more efficient!

[letiesperon]

@palkan Hi! Useful thread. I'm also looking at stubbing allowed_to? in graphQL mutation unit tests. In 2024, is this still your recommended way?

[palkan]

Thanks!

Yes, in the meantime, I still stick to this half-baked approach. Haven't had time to come back to this and incorporated into the library :(