I noticed a warning from rspec when this policy spec ran:
Using expect { }.not_to permit_actions could produce
confusing results. Please use `.to forbid_actions` instead. To
clarify, `.not_to permit_actions` will look at all of the actions and
checks if ANY actions fail, not if all actions fail. Therefore, you
could result in something like this:
it { is_expected.to permit_actions([:new, :create, :edit]) }
it { is_expected.not_to permit_actions([:edit, :destroy]) }
In this case, edit would be true and destroy would be false, but both
tests would pass.
I just follow the helpful advice.
9b5512bd9f