Friday 13th-release!
Careful! The bugfix below (#626) could break existing code. If you rely on the
return value for authorize and namespaced policies you might need to do some
changes.
.authorizeand#authorizereturn the instance, even for namespaced policies (#626)
- Generate application scope with
protectedattr_readers. (#616)
- Dropped support for Ruby end-of-life versions: 2.1 and 2.2. (#604)
- Dropped support for Ruby end-of-life versions: 2.3 (#633)
- Dropped support for Ruby end-of-life versions: 2.4, 2.5 and JRuby 9.1 (#676)
- Dropped support for RSpec 2 (#615)
- Avoid name clashes with the Error class. (#590)
- Return a safer default NotAuthorizedError message. (#583)
None
- Improve exception handling for
#policy_scopeand#policy_scope!. (#550) - Add
:policymetadata to RSpec template. (#566)
No changes since beta1
- Only pass last element of "namespace array" to policy and scope. (#529)
- Raise
InvalidConstructorErrorif a policy or policy scope with an invalid constructor is called. (#462) - Return passed object from
#authorizemethod to make chaining possible. (#385)
-
Add
policy_classoption toauthorizeto be able to override the policy. (#441) -
Add
policy_scope_classoption toauthorizeto be able to override the policy scope. (#441) -
Fix
param_keyissue when passed an array. (#529) -
Allow specification of a
NilClassPolicy. (#525) -
Make sure
policy_classoverride is called when passed an array. (#475) -
Use
action_nameinstead ofparams[:action]. (#419) -
Add
pundit_params_formethod to make it easy to customize params fetching. (#502)
- Can retrieve policies via an array of symbols/objects.
- Add autodetection of param key to
permitted_attributeshelper. - Hide some methods which should not be actions.
- Permitted attributes should be expanded.
- Generator uses
RSpec.describeaccording to modern best practices.
- Fixed a regression where NotAuthorizedError could not be ininitialized with a string.
- Use
camelizeinstead ofclassifyfor symbol policies to prevent weird pluralizations.
- Caches policy scopes and policies.
- Explicitly setting the policy for the controller via
controller.policy = foohas been removed. Instead usecontroller.policies[record] = foo. - Explicitly setting the policy scope for the controller via
controller.policy_policy = foohas been removed. Instead usecontroller.policy_scopes[scope] = foo. - Add
permitted_attributeshelper to fetch attributes from policy. - Add
pundit_policy_authorized?andpundit_policy_scoped?methods. - Instance variables are prefixed to avoid collisions.
- Add
Pundit.authorizemethod. - Add
skip_authorizationandskip_policy_scopehelpers. - Better errors when checking multiple permissions in RSpec tests.
- Better errors in case
nilis passed topolicyorpolicy_scope. - Use
inspectwhen printing object for better errors. - Dropped official support for Ruby 1.9.3
- Extend the default
ApplicationPolicywith anApplicationPolicy::Scope(#120) - Fix RSpec 3 deprecation warnings for built-in matchers (#162)
- Generate blank policy spec/test files for Rspec/MiniTest/Test::Unit in Rails (#138)
- Customizable error messages:
#query,#recordand#policymethods onPundit::NotAuthorizedError(#114) - Raise a different
Pundit::AuthorizationNotPerformedErrorwhenauthorizecall is expected in controller action but missing (#109) - Update Rspec matchers for Rspec 3 (#124)
- Customize the user to be passed into policies:
pundit_user(#42)