Install Pundit as authorization system.

[stevepolitodesign]

This will help us standardize our approach to authorization within the application. We'll need to make sure we're rendering a flash message within the application, otherwise users won't see a warning when the're redirected from an endpoint they do not have access to.

I deliberately did not enable policies and scopes everywhere, but we might want to consider this if the app requires a user to be subscribed to have access.

Other Notes

• Pundit can help with scopes
• Pundit can help with strong params

[joemasilotti]

Thanks for the PR, @stevepolitodesign! Two requests:

1. Can you add tests? We can use these to serve as documentation for someone who isn't familiar with the framework (like me!).
2. Is there a way to actually "use" this code in the app's current state? I really don't like the idea of adding code that doesn't "do" anything yet but relies on addition code to function.

[stevepolitodesign]

@joemasilotti thank you for the feedback.

I'm not actually sure I could provide any meaningful tests simply because this PR is only concerned with installing Pundit and configuring the ApplicationController to gracefully rescue_from a Pundit::NotAuthorizedError. However, we don't have any policies yet, so we'll never be in a state where we raise a Pundit::NotAuthorizedError

I was imagining this PR serving as a base for the rest of the application such the the existing issues would have access to Pundit.

Do you think it would be more beneficial to also address #10 in this PR as well? That way you would be able to see how the gem works, and we could test that particular feature.

I know @Tonksthebear is interested in this feature so I don't want to step on their toes.

[joemasilotti]

I think a PR branches off of this, or this commit cherry-picked, is the best approach. That will probably include something from #10. I'll let y'all figure that out by submitting PRs!

[joemasilotti]

Closed as these changes were included in #25.