09 · Mass Assignment และ Authorization

# Rails 8: expect = require + permit, and rejects wrongly shaped params with 400
def profile_params
  params.expect(user: [:name, :email])
end

# admin-only fields get their own permit list in the admin controller
def admin_user_params
  params.expect(user: [:name, :email, :role])
end

params.require(:user).permit!            # permits everything: never on user input

// JS stacks have the same bug: Object.assign(user, req.body) or ORM.update(req.body)
const { name, email } = req.body;              // pick fields explicitly
await User.update({ name, email }, { where: { id: req.user.id } });
await User.update(req.body, { where: { id: req.user.id } });   // mass assignment

class ApplicationController < ActionController::Base
  include Pundit::Authorization
  after_action :verify_authorized, except: :index     # forgot authorize? → error
  after_action :verify_policy_scoped, only: :index
end

class RefundsController < ApplicationController
  def create
    order = policy_scope(Order).find(params[:order_id])  # object level (BOLA)
    authorize order, :refund?                            # function level (BFLA)
    order.refund!(amount: params.expect(:amount))
  end
end

class OrderPolicy < ApplicationPolicy
  def refund? = user.manager? && record.account_id == user.account_id
  class Scope < ApplicationPolicy::Scope
    def resolve = scope.where(account_id: user.account_id)   # tenant isolation
  end
end