How Do I Test Resource-less Authorize? about action_policy HOT 1 CLOSED

Correct. In tests, you must be explicit about the authorization target object or the policy class that must be used. The goal of the test is to verify the correct policy has been used.

We can hardly infer the expected class from a test class (well, maybe, we can assume that described_class is a controller class, so we can get the name and turn it into a policy name, but that would made tests too vague). And I can see how that can lead to false positives: you change the controller name (say, PostsController > DrafsController); now a DraftPolicy is used implicitly and in tests we also implicitly check for it; but you might want to continue using PostPolicy—the test wouldn't catch this.

If I do this, how can I test it using RSpec?

expect { get posts_path }.to be_authorized_to(:index?, Post)

# or
expect { get posts_path }.to be_authorized_to(:index?, :post)

Though I think the following would be even better:

expect { get posts_path }.to be_authorized_to(:index?).with(PostPolicy)

from action_policy.