Module: ActionController::PermissionsPolicy::ClassMethods

Defined in:
actionpack/lib/action_controller/metal/permissions_policy.rb

Instance Method Summary collapse

Instance Method Details

#permissions_policy(**options, &block) ⇒ Object

Overrides parts of the globally configured ‘Feature-Policy` header:

class PagesController < ApplicationController
  permissions_policy do |policy|
    policy.geolocation "https://example.com"
  end
end

Options can be passed similar to ‘before_action`. For example, pass `only: :index` to override the header on the index action only:

class PagesController < ApplicationController
  permissions_policy(only: :index) do |policy|
    policy.camera :self
  end
end

Requires a global policy defined in an initializer, which can be empty:

Rails.application.config.permissions_policy do |policy|
  # policy.gyroscope :none
end



33
34
35
36
37
38
39
40
41
42
43
44
 
# File 'actionpack/lib/action_controller/metal/permissions_policy.rb', line 33

def permissions_policy(**options, &block)
  before_action(options) do
    unless request.respond_to?(:permissions_policy)
      raise "Cannot override permissions_policy if no global permissions_policy configured."
    end
    if block_given?
      policy = request.permissions_policy.clone
      instance_exec(policy, &block)
      request.permissions_policy = policy
    end
  end
end