diff --git a/README.md b/README.md index 5b0a6c8..7388afa 100644 --- a/README.md +++ b/README.md @@ -189,8 +189,9 @@ end ``` If you're using `verify_authorized` in your controllers but need to -conditionally bypass verification, you can use `skip_authorization`. This is -useful in circumstances where you don't want to disable verification for the +conditionally bypass verification, you can use `skip_authorization`. For +bypassing `verify_policy_scoped`, use `skip_policy_scope`. These are useful +in circumstances where you don't want to disable verification for the entire action, but have some cases where you intend to not authorize. ```ruby diff --git a/lib/pundit.rb b/lib/pundit.rb index 2bf0171..7a5d42f 100644 --- a/lib/pundit.rb +++ b/lib/pundit.rb @@ -117,6 +117,10 @@ module Pundit @_pundit_policy_authorized = true end + def skip_policy_scope + @_pundit_policy_scoped = true + end + def policy_scope(scope) @_pundit_policy_scoped = true pundit_policy_scope(scope) diff --git a/spec/pundit_spec.rb b/spec/pundit_spec.rb index ebff539..f9b5428 100644 --- a/spec/pundit_spec.rb +++ b/spec/pundit_spec.rb @@ -287,6 +287,13 @@ describe Pundit do end end + describe "#skip_policy_scope" do + it "disables policy scope verification" do + controller.skip_policy_scope + expect { controller.verify_policy_scoped }.not_to raise_error + end + end + describe "#pundit_user" do it 'returns the same thing as current_user' do expect(controller.pundit_user).to eq controller.current_user