ruby on rails - Pundit headless policy for nested resource -

how can authorize action controller without model based on model object?

let's have model called server , have nested controller called config_files_controller doesn't have corresponding model.

i want able authorize actions config_files_controller based on server object , current user , policies defined server.

in routes.rb have:

resources :servers   resources :config_files     collection       'load_file'     end   end end 

the config_files_controller.rb looks this:

class configfilescontroller < applicationcontroller   before_filter :authenticate_user!   before_filter :load_server    def index     # displays file names   end    def load_file     # gets file content   end    private    def load_server     @server = server.find(params[:server_id])     authorize :config_file, "#{action_name}?"   end end 

in configuration_file_policy.rb have this:

class configurationfilepolicy < struct.new(:user, :configuration_file, :server)   def index?     serverpolicy.new(user, server).show?   end    def load_file?     serverpolicy.new(user, server).update?   end end 

i'm missing or i'm not seeing obvious solution. suggestion appreciated!

thanks!

your controller sets @server object, , server seems model. hence should sufficient authorize that. (no need configurationfilepolicy.)

config_files_controller.rb

...  def index   authorize @server, :show?   # displays file names   ... end  def load_file   authorize @server, :update?   # gets file content   ... end 

https://github.com/elabs/pundit#policies