Do a policy check at the resource level before any other callbacks

app/controllers/albums_controller.rb

@@ -57,7 +57,7 @@ def merge
   private
 
   def set_album
-    @album = Album.find(params.expect(:id))
+    @album = policy_scope(Album).find(params.expect(:id))
     authorize @album
   end
 

app/controllers/application_controller.rb

@@ -62,10 +62,10 @@ def authenticate_user
 
   def user_not_authorized(exc)
     status = current_user.present? ? :forbidden : :unauthorized
-    render json: { errors: [{ model: exc.policy.record.model_name.singular, type: status, action: exc.query }] }, status:
+    render json: { errors: [{ model: exc.record.model_name.singular, type: status, action: action_name }] }, status:
   end
 
   def model_not_found(exc)
-    render json: { errors: [{ model: exc.model.downcase, type: :not_found }] }, status: :not_found
+    render json: { errors: [{ model: exc.model.underscore, type: :not_found }] }, status: :not_found
   end
 end

app/controllers/artists_controller.rb

@@ -57,7 +57,7 @@ def merge
   private
 
   def set_artist
-    @artist = Artist.find(params.expect(:id))
+    @artist = policy_scope(Artist).find(params.expect(:id))
     authorize @artist
   end
 

app/controllers/auth_tokens_controller.rb

@@ -15,7 +15,8 @@ def show
   end
 
   def create
-    authorize AuthToken
+    # We don't use pundit in this action since it's configured to require a user
+    skip_authorization
 
     user = User.find_by(name: params[:name])
     unless user.try(:authenticate, params[:password])
@@ -25,7 +26,7 @@ def create
 
     @auth_token = AuthToken.new(
       { user_agent: request.headers[:'user-agent'] }
-          .merge(params[:auth_token].present? ? permitted_attributes(AuthToken) : {})
+          .merge(params[:auth_token].present? ? params.expect(auth_token: %i[user_agent application]) : {})
           .merge(user:)
     )
 
@@ -43,7 +44,7 @@ def destroy
   private
 
   def set_auth_token
-    @auth_token = AuthToken.find(params.expect(:id))
+    @auth_token = policy_scope(AuthToken).find(params.expect(:id))
     authorize @auth_token
   end
 

app/controllers/codec_conversions_controller.rb

@@ -42,7 +42,7 @@ def destroy
   private
 
   def set_codec_conversion
-    @codec_conversion = CodecConversion.find(params.expect(:id))
+    @codec_conversion = policy_scope(CodecConversion).find(params.expect(:id))
     authorize @codec_conversion
   end
 

app/controllers/codecs_controller.rb

@@ -40,7 +40,7 @@ def destroy
   private
 
   def set_codec
-    @codec = Codec.find(params.expect(:id))
+    @codec = policy_scope(Codec).find(params.expect(:id))
     authorize @codec
   end
 

app/controllers/cover_filenames_controller.rb

@@ -32,7 +32,7 @@ def destroy
   private
 
   def set_cover_filename
-    @cover_filename = CoverFilename.find(params.expect(:id))
+    @cover_filename = policy_scope(CoverFilename).find(params.expect(:id))
     authorize @cover_filename
   end
 

app/controllers/genres_controller.rb

@@ -51,7 +51,7 @@ def merge
   private
 
   def set_genre
-    @genre = Genre.find(params.expect(:id))
+    @genre = policy_scope(Genre).find(params.expect(:id))
     authorize @genre
   end
 

app/controllers/image_types_controller.rb

@@ -40,7 +40,7 @@ def destroy
   private
 
   def set_image_type
-    @image_type = ImageType.find(params.expect(:id))
+    @image_type = policy_scope(ImageType).find(params.expect(:id))
     authorize @image_type
   end
 

app/controllers/labels_controller.rb

@@ -51,7 +51,7 @@ def merge
   private
 
   def set_label
-    @label = Label.find(params.expect(:id))
+    @label = policy_scope(Label).find(params.expect(:id))
     authorize @label
   end
 

app/controllers/locations_controller.rb

@@ -32,7 +32,7 @@ def destroy
   private
 
   def set_location
-    @location = Location.find(params.expect(:id))
+    @location = policy_scope(Location).find(params.expect(:id))
     authorize @location
   end
 

app/controllers/playlists_controller.rb

@@ -46,7 +46,7 @@ def add_item
   private
 
   def set_playlist
-    @playlist = Playlist.find(params.expect(:id))
+    @playlist = policy_scope(Playlist).find(params.expect(:id))
     authorize @playlist
   end
 

app/controllers/rescans_controller.rb

@@ -27,7 +27,7 @@ def start_all
   private
 
   def set_rescan
-    @rescan = RescanRunner.find(params.expect(:id))
+    @rescan = policy_scope(RescanRunner).find(params.expect(:id))
     authorize @rescan
   end
 

app/controllers/tracks_controller.rb

@@ -83,6 +83,11 @@ def merge
 
   private
 
+  def set_track
+    @track = policy_scope(Track).find(params.expect(:id))
+    authorize @track
+  end
+
   def send_file_with_range(path, mimetype)
     Rack::Files.new(nil).serving(request, path).tap do |(status, headers, body)|
       self.status = status
@@ -95,11 +100,6 @@ def send_file_with_range(path, mimetype)
     end
   end
 
-  def set_track
-    @track = Track.find(params.expect(:id))
-    authorize @track
-  end
-
   def transformed_attributes
     attributes = permitted_attributes(@track || Track)
 

app/controllers/users_controller.rb

@@ -47,7 +47,7 @@ def destroy
   private
 
   def set_user
-    @user = User.find(params.expect(:id))
+    @user = policy_scope(User).find(params.expect(:id))
     authorize @user
   end
 

app/policies/album_policy.rb

@@ -5,33 +5,13 @@ def resolve
     end
   end
 
-  def index?
-    user.present?
-  end
-
-  def show?
-    index?
-  end
-
-  def create?
-    user&.moderator?
-  end
-
-  def update?
-    user
-  end
-
-  def destroy?
-    create?
-  end
-
-  def destroy_empty?
-    create?
-  end
-
-  def merge?
-    create?
-  end
+  def index? = true
+  def show? = true
+  def create? = user.moderator?
+  def update? = true
+  def destroy? = create?
+  def destroy_empty? = create?
+  def merge? = create?
 
   def permitted_attributes
     if user.moderator?

app/policies/application_policy.rb

@@ -4,6 +4,8 @@ class ApplicationPolicy
   def initialize(user, record)
     @user = user
     @record = record
+
+    raise Pundit::NotAuthorizedError.new(message: 'must be logged in', policy: self, record:) if user.blank?
   end
 
   class Scope
@@ -12,6 +14,8 @@ class Scope
     def initialize(user, scope)
       @user = user
       @scope = scope
+
+      raise Pundit::NotAuthorizedError.new(message: 'must be logged in', policy: self, record: scope.none.model) if user.blank?
     end
   end
 end

app/policies/artist_policy.rb

@@ -5,33 +5,13 @@ def resolve
     end
   end
 
-  def index?
-    user.present?
-  end
-
-  def show?
-    index?
-  end
-
-  def create?
-    user&.moderator?
-  end
-
-  def update?
-    user
-  end
-
-  def destroy?
-    create?
-  end
-
-  def destroy_empty?
-    create?
-  end
-
-  def merge?
-    create?
-  end
+  def index? = true
+  def show? = true
+  def create? = user.moderator?
+  def update? = true
+  def destroy? = create?
+  def destroy_empty? = create?
+  def merge? = create?
 
   def permitted_attributes
     if user.moderator?

app/policies/auth_token_policy.rb

@@ -5,23 +5,7 @@ def resolve
     end
   end
 
-  def index?
-    user.present?
-  end
-
-  def show?
-    user.present? && record.user == user
-  end
-
-  def create?
-    true
-  end
-
-  def destroy?
-    show?
-  end
-
-  def permitted_attributes
-    %i[user_agent application]
-  end
+  def index? = true
+  def show? = record.user == user
+  def destroy? = show?
 end

app/policies/codec_conversion_policy.rb

@@ -5,25 +5,11 @@ def resolve
     end
   end
 
-  def index?
-    user.present?
-  end
-
-  def show?
-    index?
-  end
-
-  def create?
-    user&.moderator?
-  end
-
-  def update?
-    create?
-  end
-
-  def destroy?
-    create?
-  end
+  def index? = true
+  def show? = true
+  def create? = user.moderator?
+  def update? = create?
+  def destroy? = create?
 
   def permitted_attributes
     %i[name ffmpeg_params resulting_codec_id]

app/policies/codec_policy.rb

@@ -5,25 +5,11 @@ def resolve
     end
   end
 
-  def index?
-    user.present?
-  end
-
-  def show?
-    index?
-  end
-
-  def create?
-    user&.moderator?
-  end
-
-  def update?
-    create?
-  end
-
-  def destroy?
-    create?
-  end
+  def index? = true
+  def show? = true
+  def create? = user.moderator?
+  def update? = create?
+  def destroy? = create?
 
   def permitted_attributes_for_create
     %i[mimetype extension]