check authorization is sufficient in an after_filter when doing enable_authorization

lib/cancan/ability.rb

@@ -225,14 +225,6 @@ module CanCan
       end
     end
 
-    def sufficient_attribute_check?(action, subject, attribute)
-      !(%w[create update].include?(action.to_s) && attribute.nil? && has_attributes?(action, subject))
-    end
-
-    def sufficient_condition_check?(action, subject)
-      !((subject.kind_of?(Symbol) || subject.kind_of?(String)) && has_instance_conditions?(action, subject))
-    end
-
     def unauthorized_message(action, subject)
       keys = unauthorized_message_keys(action, subject)
       variables = {:action => action.to_s}
@@ -286,6 +278,14 @@ module CanCan
       end.flatten
     end
 
+    def sufficient_attribute_check?(action, subject, attribute)
+      !(%w[create update].include?(action.to_s) && attribute.nil? && has_attributes?(action, subject))
+    end
+
+    def sufficient_condition_check?(action, subject)
+      !((subject.kind_of?(Symbol) || subject.kind_of?(String)) && has_instance_conditions?(action, subject))
+    end
+
     # Accepts an array of actions and returns an array of actions which match.
     # This should be called before "matches?" and other checking methods since they
     # rely on the actions to be expanded.

lib/cancan/controller_additions.rb

@@ -253,9 +253,16 @@ module CanCan
       #
       def enable_authorization(options = {})
         self.before_filter(options.slice(:only, :except)) do |controller|
-          return if options[:if] && !controller.send(options[:if])
-          return if options[:unless] && controller.send(options[:unless])
-          authorize! controller.params[:action], controller.params[:controller]
+          break if options[:if] && !controller.send(options[:if])
+          break if options[:unless] && controller.send(options[:unless])
+          controller.authorize! controller.params[:action], controller.params[:controller]
+        end
+        self.after_filter(options.slice(:only, :except)) do |controller|
+          break if options[:if] && !controller.send(options[:if])
+          break if options[:unless] && controller.send(options[:unless])
+          unless controller.current_ability.fully_authorized? controller.params[:action], controller.params[:controller]
+            raise CanCan::InsufficientAuthorizationCheck, "Authorization check is not sufficient for this action. This is probably because you have a conditions or attributes defined in Ability and are not checking for them in the action."
+          end
         end
       end
 

lib/cancan/exceptions.rb

@@ -11,6 +11,9 @@ module CanCan
   # Raised when using check_authorization without calling authorized!
   class AuthorizationNotPerformed < Error; end
 
+  # Raised when enable_authorization is used and not fully authorized by the end of the action
+  class InsufficientAuthorizationCheck < Error; end
+
   # This error is raised when a user isn't allowed to access a given controller action.
   # This usually happens within a call to ControllerAdditions#authorize! but can be
   # raised manually.