authorize_action_for only passes non-blank options

lib/authority.rb

@@ -30,10 +30,13 @@ def self.adjectives
   # @raise [SecurityViolation] if user is not allowed to perform action on resource
   # @return [Model] resource instance
   def self.enforce(action, resource, user, *options)
-    action_authorized = user.send("can_#{action}?", resource, Hash[*options])
-    unless action_authorized
-      raise SecurityViolation.new(user, action, resource)
-    end
+    action_authorized = if options.empty?
+                          user.send("can_#{action}?", resource)
+                        else
+                          user.send("can_#{action}?", resource, Hash[*options])
+                        end
+    raise SecurityViolation.new(user, action, resource) unless action_authorized
+
     resource
   end
 

spec/authority/controller_spec.rb

@@ -95,7 +95,7 @@
         @controller.send(:run_authorization_check)
       end
 
-      it "should pass the options provided to `authorize_actions_for` downstream" do
+      it "should pass the options provided to `authorize_action_for` downstream" do
         @controller.stub!(:action_name).and_return(:destroy)
         Authority.should_receive(:enforce).with('delete', ExampleModel, @user, :for => 'context')
         @controller.send(:authorize_action_for, ExampleModel, :for => 'context')

spec/authority_spec.rb

@@ -44,13 +44,23 @@
       @user = User.new
     end
 
-    it "should pass options given through to the user auth ability" do
-      options = { :for => 'context' }
+    describe "if given options" do
 
-      # Stub with explicit args serves an expectation role here; also avoids adding deletable_by?
-      @user.stub!(:can_delete?).with(ExampleModel, options).and_return(true)
+      it "should check the user's authorization, passing along the options" do
+        options = { :for => 'context' }
+        @user.should_receive(:can_delete?).with(ExampleModel, options).and_return(true)
+        Authority.enforce(:delete, ExampleModel, @user, options)
+      end
+
+    end
+
+    describe "if not given options" do
+
+      it "should check the user's authorization, passing no options" do
+        @user.should_receive(:can_delete?).with(ExampleModel).and_return(true)
+        Authority.enforce(:delete, ExampleModel, @user)
+      end
 
-      Authority.enforce(:delete, ExampleModel, @user, options)
     end
 
     it "should raise a SecurityViolation if the action is unauthorized" do