Expected Behavior

Not sure if this is something helpful or out of scope of this library, but I though to at least leave it here in case it is useful for anyone else.

In our application we use gem Pundit with policy scopes to define records accessible by a user. By default the serializer returns all associated records, potentially exposing records that should not be returned.

We solved it by using the following code:

class MovieSerializer
  include JSONAPI::Serializer

  has_many :actors do |movie, params|
    Pundit.policy_scope(params[:current_user], movie.actors)
  end