elabs/pundit — pull request #50 by coop (2013-08-12 07:20:00+00:00)
Title: Allow authorize to pass arguments to policy methods.

`authorize` currently assumes that each policy has enough information to make a decision. I have found that this is often not the case as described in the policy below.

``` ruby
class ProjectPolicy
# Determine if user is allowed to remove other_user from the project.
#
# @return [Boolean]
def remove_user?(other_user)
user != other_user && project.owned_by?(user)
end
end
```

`authorize` has been patched to send any extra arguments to the policy which
makes the above possible.

class ProjectsController < ApplicationController
include Pundit

# This isn't RESTful but shows intent.
def remove_user
authorize project, :remove_user?, other_user

project.remove_user other_user
respond_with project
end

private

def project
@project ||= current_user.find_project params[:id]
end

def other_user
@other_user ||= project.find_user params[:user_id]
end
end
```