Question

I would like to create a checking tool/rake task, that would dynamically go through all the public methods that are possibly accessible from outside world and check our authorization rules.

For this I would need to collect all the controllers and all its public methods. How to do that? I would like to use Ruby reflection or metadata techniques rather than grepping files.

Answer 1

AFAICT this is impossible to do in the general case as you can’t tell which params go where, e.g. /items/foo/id or /items/foo?bar=baz ? Also, which values of the params are ok ?

But you can get a decent value with

Rails.application.routes.routes.map(&:path)

which shall give you a list in the form used in rake routes (/klass/:id/action(.:format))