Release v2.4.0

[Burgestrand]

Improve NotAuthorizedError message to include policy class (#812)

Default error message changed from:

not allowed to destroy? this Comment

To include the policy class:

not allowed to Project::Admin::CommentPolicy#destroy? this Comment

Improve NotAuthorizedError when record is a class

Before:

not allowed to index? this Class

After:

not allowed to PostPolicy#index? Post

Allow customizing rspec matcher description (#806)

Before:

PostPolicy
  update? and show?
    is expected to permit #<User:0x0000000104aefd80> and #<Post:0x0000000104aef8d0 @user=#<User:0x0000000104aefd80>>

In spec_helper.rb:

Pundit::RSpec::Matchers.description = ->(user, record) do
  "permit user with role #{user.role} to access record with ID #{record.id}"
end

After:

PostPolicy
  update? and show?
    is expected to permit user with role admin to access record with ID 130

Add support for filter_run_when_matching :focus with permissions helper (#820)

If your RSpec config has filter_run_when_matching :focus, you may tag the permissions helper like so:

permissions :show?, :focus do

To do

• Make changes:
  • Bump Pundit::VERSION in lib/pundit/version.rb.
  • Update CHANGELOG.md.
• Open pull request 🚀 and merge it.
• Run push gem GitHub Action.
• Make an announcement in Pundit discussions