How to use assert_authorized_to when creating a new record?

[joelzwarrington]

How can I use the assert_authorized_to test helper when there isn't an instance I can point to?

assert_authorized_to(:create?, Post, context: { user: @user }) do
  assert_difference("Post.count") do
    post posts_url, params: { post: { content: "Hello World" } }
  end
end

[palkan]

Is the example you provided no working? Could you please tell a bit more.

[joelzwarrington]

Hi @palkan, it is not working because my controller action will look like this:

def create
  @post = Post.new(post_params)
  authorize! @post
  @post.save
  
  # ...
end

assert_authorized_to doesn't work because it expects a record to be passed, but it's not the same instance.

[palkan]

Yeah, well, I'd suggest not using non-persistent records as authorization objects; you should either authorize the class (so, check an ability to create objects of a given type) or authorize another object that gives permission to perform this action.