For a create request that looks like this:

{
  "data": {
    "id": "post-1",
    "type": "posts",
    "relationships": {
      "author": {
        "data": {
          "id": "user-1", "type": "user"
        }
      },
      "comments": {
        "data": [
          { "id": "comment-1", "type": "comments" },
          { "id": "comment-2", "type": "comments" }
        ]
      },
      "tags": {
        "data": [
          { "id": "tag-1", "type": "tags" },
          { "id": "tag-2", "type": "tags" }
        ]
      }
    }
  }
}

We authorize with these methods:

1. PostPolicy.new(post_1, current_user).create?
2. PostPolicy.new(post_1, current_user).associate_with_author(user_1)?
3. PostPolicy.new(post_1, current_user).associate_with_comments([comment_1, comment_2])?
4. PostPolicy.new(post_1, current_user).associate_with_tags([tag_1, tag_2])?

For this request, no matter if it's an update or a create call, we are able to only use PostPolicy to authorize for every association.

I can't see there being any other way as we ​_cannot_​ change the UserPolicy#associate_with_comments call to these without a huge scope creep:

1. CommentPolicy.new(comment_1, user).associate_with_post(post_1)?
2. CommentPolicy.new(comment_2, user).associate_with_post(post_1)?

Who knows, the Comment resource might even call that association with a completely different name than post underneath!

If that request would be an update request, it would only change the PostPolicy#create? call to be PostPolicy#update? and the association checks would remain the same.

I know this goes against Pundit architecture, but I can't really see there being any other way because we aren't able to call post_1.author = author_1 nor post_1.comments = [comment_1, comment_2] before authorizing as it would implicitly save the association immediately. So we aren't able to just use the post_1.author value in PostPolicy#update? to check for authorization, as it isn't set yet.

• has_one association reference —  When are objects saved? (Ruby on Rails Guides)

  When you assign an object to a has_one association, that object is automatically saved (in order to update its foreign key). In addition, any object being replaced is also automatically saved, because its foreign key will change too.

• has_many association reference — When are objects saved? (Ruby on Rails Guides)

  When you assign an object to a has_many association, that object is automatically saved (in order to update its foreign key). If you assign multiple objects in one statement, then they are all saved.