🚨 enhancement: preview policy

[Paul-Bob]

Description

Fixes #3513

A new policy method is available: preview?.

This method determines whether a preview request is authorized.

🚨 Breaking Change: Previously, the preview endpoint was always authorized.
Now, access is denied unless the preview? policy method explicitly returns true.

Steps to Update

To maintain the previous behavior of preview fields, add the preview?
method returning true in your base policy class:

# app/policies/application_policy.rb
class ApplicationPolicy
  def preview? = true
end

You can now refine this method to restrict access for specific users or even default it to false. The example above simply ensures that behavior remains unchanged after upgrading.

Checklist:

• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
  • Preview authorization docs.avohq.io#347
• I have added tests that prove my fix is effective or that my feature works

Screenshots & recording

[codeclimate]

Code Climate has analyzed commit 4dadef5 and detected 0 issues on this pull request.

View more on Code Climate.