Fix Pundit::NotAuthorizedError: not allowed to update? this Article in Rails

This error means the current user does not have permission to perform the requested action according to your Pundit policy. Pundit checked the policy class for the resource and the method returned false. Review your policy file to ensure the authorization logic correctly grants access to the appropriate user roles.

Reading the Stack Trace

Here's what each line means:

• pundit (2.3.2) lib/pundit/authorization.rb:110:in `authorize': Pundit's authorize method checked the ArticlePolicy#update? method and it returned false.
• app/controllers/articles_controller.rb:22:in `update': The controller calls authorize @article which triggers the policy check.
• actionpack (7.1.3) lib/abstract_controller/base.rb:224:in `process_action': The standard Rails action processing pipeline where the authorization check occurs.

Common Causes

# app/policies/article_policy.rb
class ArticlePolicy < ApplicationPolicy
  def update?
    user.admin?  # Only admins can update, but editors should too
  end
end

class ArticlePolicy < ApplicationPolicy
  def create?
    true
  end
  # update? is not defined, inherits from ApplicationPolicy which returns false
end

def update
  @article = Article.find(params[:id])
  authorize @article.category  # Should be authorize @article
  @article.update!(article_params)
end

The Fix

Expand the update? policy method to allow admins, editors, and the article's author to update. This follows the principle of least privilege while enabling the correct users to perform the action.

class ArticlePolicy < ApplicationPolicy
  def update?
    user.admin?
  end
end

class ArticlePolicy < ApplicationPolicy
  def update?
    user.admin? || user.editor? || record.author == user
  end
end

Testing the Fix

require 'rails_helper'

RSpec.describe ArticlePolicy do
  let(:admin) { build(:user, role: 'admin') }
  let(:editor) { build(:user, role: 'editor') }
  let(:author) { build(:user) }
  let(:other_user) { build(:user) }
  let(:article) { build(:article, author: author) }

  describe '#update?' do
    it 'allows admin' do
      expect(ArticlePolicy.new(admin, article).update?).to be true
    end

    it 'allows editor' do
      expect(ArticlePolicy.new(editor, article).update?).to be true
    end

    it 'allows author' do
      expect(ArticlePolicy.new(author, article).update?).to be true
    end

    it 'denies other users' do
      expect(ArticlePolicy.new(other_user, article).update?).to be false
    end
  end
end

Run your tests:

bundle exec rspec spec/policies/article_policy_spec.rb

Pushing Through CI/CD

git checkout -b fix/rails-pundit-authorization,git add app/policies/article_policy.rb spec/policies/article_policy_spec.rb,git commit -m "fix: allow editors and authors to update articles",git push origin fix/rails-pundit-authorization

Your CI config should look something like this:

name: CI
on:
  pull_request:
    branches: [main]
jobs:
  test:
    runs-on: ubuntu-latest
    services:
      postgres:
        image: postgres:16
        env:
          POSTGRES_PASSWORD: postgres
        ports: ['5432:5432']
    steps:
      - uses: actions/checkout@v4
      - uses: ruby/setup-ruby@v1
        with:
          ruby-version: '3.3'
          bundler-cache: true
      - run: bin/rails db:setup
      - run: bundle exec rspec

The Full Manual Process: 18 Steps

Here's every step you just went through to fix this one bug:

1. Notice the error alert or see it in your monitoring tool
2. Open the error dashboard and read the stack trace
3. Identify the file and line number from the stack trace
4. Open your IDE and navigate to the file
5. Read the surrounding code to understand context
6. Reproduce the error locally
7. Identify the root cause
8. Write the fix
9. Run the test suite locally
10. Fix any failing tests
11. Write new tests covering the edge case
12. Run the full test suite again
13. Create a new git branch
14. Commit and push your changes
15. Open a pull request
16. Wait for code review
17. Merge and deploy to production
18. Monitor production to confirm the error is resolved

Total time: 30-60 minutes. For one bug.

gem install bugstack

require 'bugstack'

Bugstack.init(api_key: ENV['BUGSTACK_API_KEY'])

Deploying the Fix (Manual Path)

1. Update the policy method with correct authorization logic.
2. Add comprehensive policy specs for all user roles.
3. Run the full test suite.
4. Open a pull request.
5. Merge and verify authorization works in staging.

Frequently Asked Questions