Custom Exceptions and Messages

[saturnflyer]

I've seen some discussion around handling custom exceptions and I want to find out if I can contribute to the effort.

I'm currently patching Pundit in my application like this:

# This module is used to patch Pundit to allow for a custom exception class to be raised
module PunditExceptions
  def raise(klass, query:, record:, policy:)
    if policy.respond_to?(:exception_from)
      super(policy.exception_from(query:), query: query, record: record, policy: policy)
    else
      super
    end
  end
end
Pundit.singleton_class.prepend(PunditExceptions)

Because the Pundit.authorize method has no place to specify a custom exception class, the only way to hook into it is to alter the raise method.

This patch allows me to define an exception_from method in my policies which can return alternative exception classes.

This is how you can use it:

class WidgetPolicy < ApplicationPolicy
  class CustomException < Pundit::NotAuthorizedError
    def initialize(options = {})
      options[:message] = "My custom exception message"
      super(options)
    end
  end

  def exception_from(query:)
    if some_policy_check?
      CustomException
    else
      Pundit::NotAuthorizedError
    end
  end
end

The upside of this is that there's little chance of this causing trouble if Pundit changes upstream from my patch.
One downside is that the else case needs to always return the Pundit::NotAuthorizedError, or the ApplicationPolicy could just define this method to have a default and we'd always call super in the else clause.
Or my ApplicationPolicy could instead add an alternative method path to ensure that it works if people forget to add the super call.
For example:

class ApplicationPolicy
  def exception_from(query:)
    exception_class = if respond_to?(:custom_exception)
      custom_exception(query:)
    end

    exception_class || Pundit::NotAuthorizedError
  end
end

class WidgetPolicy < ApplicationPolicy
  def custom_exception(query:)
    if query == "create?"
      SomeCustomException
    elsif some_policy_check
      OtherCustomException
    end
    # no need to remember `super` or a default
  end
end

There seems to be no currently blessed way to handle custom exceptions and because policies are just simple objects that have minimal requirements, this would add some additional overhead to what those objects need to do. Checking respond_to? isn't ideal but the alternative would be that the policies would need some new requirement to specify some method to return the exception class.
The generator could define a method like exception_from or custom_exception (or whatever makes sense) and to avoid regular respond_to? checking that would require all existing projects to define the appropriate method to work with some version of pundit that required it. I'm not sure if that's an acceptable addition to the required API for policy objects.

This is what I'm currently doing in my project and I wanted to share it and get feedback if something like this would be an acceptable addition to Pundit.

[AkshayaSasidharan]

In the authorize method, NotAuthorizedError class will be called if authorisation fails. When does this raise method will be triggered?

[saturnflyer]

The NotAuthorizedError is not called, it is raised through the raise method.

pundit/lib/pundit.rb

Line 86 in aabb344

raise NotAuthorizedError, query: query, record: record, policy: policy unless policy.public_send(query)

My PunditExceptions module overrides that method.

[saturnflyer]

I wrapped up this and other features into https://github.com/SOFware/pundit-plus