RSpec example for rails authorisation with Pundit's policy_scope method

post_policy_spec.rb

describe PostPolicy do
  let(:scope) { Post.where(:published => true }
  subject(:policy_scope) { PostPolicy::Scope.new(user, scope).resolve }

  permissions ".scope" do
    context "for an ordinary user"
      let(:user)  { User.new(:admin => false) }

      it "hides unpublished post" do
        post = Post.create(:published => false)
        expect(policy_scope).to eq []
      end

      it "shows published post" do
        post = Post.create(:published => true)
        expect(policy_scope).to eq [post]
      end
    end

    context "for an admin user"
      let(:user)  { User.new(:admin => true) }

      it "shows unpublished post" do
        post = Post.create(:published => false)
        expect(policy_scope).to eq [post]
      end

      it "shows published post" do
        post = Post.create(:published => true)
        expect(policy_scope).to eq [post]
      end
    end
  end
end