title: Rails: Testing authorization (Pundit) with RSpec
body: <p>I'd like to thoroughly test a Rails application authorization setup (Pundit) with RSpec.</p>
  
  <ol>
  <li><p>The <a href="https://github.com/elabs/pundit#policy-specs" rel="noreferrer">Pundit docs</a> and <a href="http://www.thunderboltlabs.com/blog/2013/03/27/testing-pundit-policies-with-rspec" rel="noreferrer">other respectful sources</a> suggest writing unit tests for Pundit policy classes. Are those tests testing behavior (good) or implementation details (bad)?</p></li>
  <li><p>If we were actually testing behavior, shouldn't our tests still pass if we eventually switched from Pundit to another authorization gem or rolled our own authorization? </p></li>
  <li><p>Suppose a call to the <code>authorize</code> method is accidentally removed from a controller action, leaving it open for public access. Pundit policy tests will keep passing. If we have no other tests covering this, our test suite may be all green while our app has a serious security vulnerability. How can we avoid this? Maybe write unit tests for Pundit controller classes, separate unit tests for controllers and mock the <code>authorize</code> method in the controller tests to ensure they are called?</p></li>
  </ol>
  
  <p><strong>Edit:</strong> On second thought, I had a lapse of judgment regarding the difference between implementation details and the public API for a class. Calling specific public methods, passing specific arguments and expecting specific return values is a requirement to unit-test (and to use) any class. Please disregard item 3 as
   my original argument is invalid.</p>
  
  <ol start="4">
  <li>Instead of testing Pundit policy classes, we could write controller or request specs that login with different user roles, call the controller actions and assert whether access was granted or denied. In this approach, the tests would keep passing even if we switched to another authorization gem. Also, they would fail if the <code>authorize</code> method is not called. However, these would be integration tests and should be slower that unit testing Pundit policy classes. Could that be a better way to test the authorization setup?</li>
  </ol>
  
  <p>Thanks in advance.</p>