Namespaced Pundit Policies Without the Repetition Racket

If you’re using Pundit in a Rails app with namespaced policies — for example, Admin::PostPolicy — you’ve probably seen the official recommendation that goes something like this:

class AdminController < ApplicationController
  def policy_scope(scope)
    super([:admin, scope])
  end

  def authorize(record, query = nil)
    super([:admin, record], query)
  end
end

class Admin::PostController < AdminController
  def index
    policy_scope(Post)
  end

  def show
    post = authorize Post.find(params[:id])
  end
end

Yeah, it works. But repeating that in every base controller gets old fast — and feels a bit noisy.

Let’s clean it up.

Here’s a small concern you can drop into app/controllers/concerns/namespaced_policy.rb:

# Controller concern for namespaced Pundit policies
#
# Usage:
#   include NamespacedPolicy::Policy(:users)
#   include NamespacedPolicy::Policy(:admin)
module NamespacedPolicy
  def self.Policy(scope)
    Module.new do
      define_method :policy_scope do |scope_class|
        super([scope, scope_class])
      end

      define_method :authorize do |record, query = nil|
        super([scope, record], query)
      end

      private :policy_scope, :authorize
    end
  end
end

And now your controllers stay nice and tidy:

class AdminController < ApplicationController
  include NamespacedPolicy::Policy(:admin)
end

class Admin::PostController < AdminController
  def index
    policy_scope(Post)
  end

  def show
    post = authorize Post.find(params[:id])
  end
end

Much cleaner. Less boilerplate. Your future self will thank you.