Adds tests to cover policy overrides and when authorize is called in other namespaces

[TheDevJoao]

This PR adds more tests as suggested in this comment from the issue #723

To do

• I have read the contributing guidelines.
• I have added relevant tests.
• No documentation alterations required.
• I have made sure the individual commits are meaningful.
• I have added relevant lines to the CHANGELOG.

PS: Thank you for contributing to Pundit ❤️

[TheDevJoao]

Hey @dgmstuart, could you check this out in the near future? I'd appreciate any feedback, thanks! 😄

[dgmstuart]

Thanks for the submission.

A number of these tests seem to be stubbing (eg. allow(controller).to receive(x)...) and then testing the stub (expect(controller.x)....).

It seems like these tests aren't actually exercising the application code. An important principle to follow is never stub the system under test.

Please remove those tests or change them so that they're actually exercising the Pundit code.

[TheDevJoao]

@dgmstuart Any updates on this PR?

[dgmstuart]

Hi - so sorry for the absurd delay - I've been crunching on a project for a long stretch and haven't had any headspace for Pundit.

I'm afraid I don't understand what these specs are intended to cover: I need a little more explanation.

[dgmstuart]

This context says "when the policy is overridden", but it doesn't look like anything is being overriden? What's the "policy" which is being overridden (do you mean the policy method, or the Policy class?), and where is it overridden?

I see there are some new things added in the spec_helper but none of those override policy_class, authorize, policy, Post or PostPolicy, so this spec looks like it just tests that ::PostPolicy works - nothing to do with any overriding?

What am I missing?

If I understand it correctly, the "overriding" which the original issue was talking about defining policy or authorize in a specific controller - eg. in an admin controller you might want to do something like this:

  def authorize(record, query = nil)
    super([:admin, record], query)
  end

  def policy(record)
    super([:admin, record])
  end 

...to make sure that calls to authorize(Post) and policy(Post) in that controller end using the Admin::PostPolicy instead of ::PostPolicy.

I'm actually using this exact override of authorize in my current project.