varvet/pundit
Pundit
Pundit is an authorization framework for Ruby applications that enforces permissions through plain Ruby policy objects. It maps controller actions to policy methods, automatically inferring which policy class and query method to call based on the action name, and raises a custom exception when access is denied.
The framework distinguishes itself by using plain Ruby classes without external DSLs or configuration files, and by providing a development-time verification guard that raises an error if a controller action runs without an authorization call. It also supports namespace-based policy organization, allowing different contexts to use separate policy classes, and includes a scope-class mechanism that restricts database query results to records the current user is permitted to see.
Additional capabilities include the ability to override the default user resolution method, rescue denied authorization exceptions to redirect users with custom messages, and test policy permissions through expressive specs that validate which roles are allowed or denied specific actions. The project also maintains a code of conduct to govern community interactions.