Allow policies to be injected into controllers.

In controller specs instead of relying on Pundit to instantiate the correct
policy object allow it to be injected into the controller. More often than not
a double is used in controller specs which means the policy cannot be
inferred. This also allows us to double the policy to ensure that on a unit
level the rights methods are being called on callaborators.

class PostsController < ApplicationController
  attr_writer :post
  helper_method :post

  def create
    authorize post

    post.save
    respond_with post
  end

  private

  def post
    @post ||= Post.new post_attributes
  end
end

describe PagesController do
  let(:policy) { double 'SomePolicy', create?: true }

  before do
    controller.policy = policy
  end

  it 'delegates authorization to policy' do
    expect(policy).to have_received(:create?)
  end
end
Allow authorize to pass arguments to policy methods.

`authorize` currently assumes that each policy has enough information to
make a decision. I have found that this is often not the case as described in
the policy below.

class ProjectPolicy
  # Determine if user is allowed to remove other_user from the project.
  #
  # @return [Boolean]
  def remove_user?(other_user)
    user != other_user && project.owned_by?(user)
  end
end

`authorize` has been patched to send any extra arguments to the policy which
makes the above possible.

class ProjectsController < ApplicationController
  include Pundit

  # This isn't RESTful but shows intent.
  def remove_user
    authorize project, :remove_user?, other_user

    project.remove_user other_user
    respond_with project
  end

  private

  def project
    @project ||= current_user.find_project params[:id]
  end

  def other_user
    @other_user ||= project.find_user params[:user_id]
  end
end
Merge branch 'allow_authorize_to_pass_arguments_to_policy_methods'
conf