[question]Can I call other policy's method?

[liubin]

Hi

for example , I have two models with the has_many relations:

Goods has_many Orders

I want to ensure only the Goods' owner can modify the orders.
I created two policy classes

class GoodsPolicy
   def admin?
     # some approach to judge weather the user is an admin and can modify the goods.
   end
end

class OrderPolicy
    def edit?
      authorize @order.goods, :admin?
    end
end

To use the authorize method in a policy class, I must add this to the OrderPolicy class:

  include Pundit

  def current_user
    @user
  end

My question is that this is an right usage of Pundit? Or there is an more ideal approach?

BR.

[deefour]

There are others here better informed on the best practice for what you're trying to do, but there's definitely no need to call authorize from within the policy.

class OrderPolicy
  def edit?
    GoodsPolicy.new(@user, @order.goods).admin?
  end
end

[liubin]

@deefour Thank you, that great!