Call authorize_resource on the index action

app/controllers/administrate/application_controller.rb

@@ -3,6 +3,7 @@ class ApplicationController < ActionController::Base
     protect_from_forgery with: :exception
 
     def index
+      authorize_resource(resource_class)
       search_term = params[:search].to_s.strip
       resources = Administrate::Search.new(scoped_resource,
                                            dashboard_class,

spec/controllers/admin/orders_controller_spec.rb

@@ -12,21 +12,16 @@ def pundit_user
       end
     end
 
-    let!(:user) { create :customer }
+    let(:user) { create(:customer) }
 
-    before(:each) do
-      # Create a few orders for the user and a few for other customers
-      create_list :order, 4, customer: create(:customer)
-      create_list :order, 7, customer: user
-      create_list :order, 2, customer: create(:customer)
-      create_list :order, 2, customer: user
-    end
-
-    # Policies are defined in order_policy.rb
     describe "GET index" do
       it "shows only the records in the admin scope" do
+        order = create(:order, customer: user)
+        _missing_order = create(:order)
+
         locals = capture_view_locals { get :index }
-        expect(locals[:resources].count).to eq(9) # only my orders
+
+        expect(locals[:resources]).to contain_exactly(order)
       end
     end
 

spec/example_app/app/policies/application_policy.rb

@@ -7,7 +7,7 @@ def initialize(user, record)
   end
 
   def index?
-    false
+    true
   end
 
   def show?