title: Using gem pundit, why author of a post cannot edit or delete it in Ruby on Rails 4.0.2?
body: <p>I am newbie to rails using <code>ruby</code> 1.9.3 and <code>rails</code> 4.0.2 and <code>pundit</code> 0.2.1</p>
  
  <p>The post model consists of: </p>
  
  <pre><code>belongs_to :user
  </code></pre>
  
  <p>The user model is generated by using <code>devise</code> gem (and does <strong>not</strong> have <code>has_many :posts</code>)</p>
  
  <pre><code>devise :database_authenticatable, :registerable,
       :rememberable, :trackable, :validatable
  </code></pre>
  
  <p>I did <code>rake db:drop db:create db:migrate</code> and my <code>schema.rb</code> now has <code>user_id</code> in <code>posts</code> table.</p>
  
  <p>Then I followed this <a href="http://www.ruby-on-rails-outsourcing.com/articles/2012/11/23/getting-started-with-pundit/" rel="nofollow">blog</a> for using gem <code>pundit</code></p>
  
  <p>I have exactly the same code shown in that blog. Furthermore I added this to my post controller actions:</p>
  
  <pre><code>def create
      @post = Post.new(params[:post].permit(:title, :text))
    authorize @post
      if @post.save
          redirect_to @post
      else
          render 'new'
      end
  end
  
  def edit
      @post = Post.find(params[:id])
    authorize @post
  end
  
  def update
      @post = Post.find(params[:id])
    authorize @post 
      if @post.update(params[:post].permit(:title, :text))
          redirect_to @post
      else
          render 'edit'
      end
  end
  
  def destroy
      @post = Post.find(params[:id])
    authorize @post
      @post.destroy
  
      redirect_to posts_path
  end
  </code></pre>
  
  <p>I am not getting any kind of error(<code>NoMethodError</code> like I got when I used <code>cancan</code> gem).</p>
  
  <p>But <strong>no user</strong>, not even the author of post, is able to edit and destroy his post.</p>
  
  <p>It simply shows  <code>Couldn't find post</code>. (which is alert message from <code>rescue_from</code> <code>Pundit::NotAuthorizedError</code>)</p>
  
  <p>I tried changing logic in <code>PostPolicy</code> <code>owned</code> method which is there in blog post but it didn't work.</p>
  
  <p>With these models and schema, how can I achieve this simple authorization (only author of post should be able to edit and delete his post) without using any gems?</p>
  
  <p>I tried other similar questions over here but none worked for me.</p>
  
  <p>As my authorization is working, now i am struggling customising <code>views</code> specifically <code>edit</code> and <code>destroy</code> links for posts <code>index.html.erb</code></p>
  
  <p>Only Author of a post must be shown edit and delete links for his posts.</p>
  
  <p>I followed <a href="https://github.com/elabs/pundit" rel="nofollow">elabs/pundit</a> for customising views by using policy method.</p>
  
  <p>Here is my code for <code>post_policy.rb</code></p>
  
  <pre><code>class PostPolicy &lt; Struct.new(:user, :post)
    def owned
      post.user_id == user.id
    end
  
    def create?
      post.user_id = user.id
      new?
    end
  
    def new?
      true
    end
  
    def update?
     edit?
    end
  
    def edit?
      owned
    end
  
    def destroy?
      owned
    end
  end 
  </code></pre>
  
  <p>And this is the code in post <code>index.html.erb</code></p>
  
  <pre><code>&lt;% if policy(Post).edit? %&gt;
    &lt;td&gt;&lt;%= link_to 'Edit', edit_post_path(post) %&gt;&lt;/td&gt;
  &lt;% end %&gt;
  
  &lt;% if policy(Post).destroy? %&gt;
    &lt;td&gt;&lt;%= link_to 'Destroy', post_path(post), method: :delete, data: { confirm: 'Are you sure?' } %&gt;&lt;/td&gt;
  &lt;% end %&gt;
  </code></pre>
  
  <p>According to pundit documentation on <a href="https://github.com/elabs/pundit" rel="nofollow">elabs/pundit</a> it says we can get instance of the <code>policy</code> through the <code>policy</code> method in both the <code>view</code> and <code>controller</code>.</p>
  
  <p>For me it gives <code>NoMethodError in Posts#index</code> and <code>undefined method user_id for &lt;Class:0x22d64d8&gt;</code> </p>
  
  <p>I have user_id field in post.
  I think i need to pass @post with policy for getting that user_id.
  I tried other ways but no success.</p>