@@ -3,6 +3,7 @@
 # * permitted_params
 class UseCaseController < ApplicationController
   before_filter :authenticate_user!
+  before_filter ->{authorize self.model_class.new}, only: [:new, :create]
   before_filter ->{authorize self.proposal}, only: [:edit, :update]
   rescue_from Pundit::NotAuthorizedError, with: :auth_errors
   before_filter :find_model_instance, only: [:edit, :update]
# Abstract controller – requires the following methods on the subclass:
# * model_class
# * permitted_params
class UseCaseController < ApplicationController
  before_filter :authenticate_user!
  before_filter ->{authorize self.proposal}, only: [:edit, :update]
  rescue_from Pundit::NotAuthorizedError, with: :auth_errors
  before_filter :find_model_instance, only: [:edit, :update]


  def new
    @model_instance = self.model_class.new
    render 'form'
  end

  def create
    @model_instance = self.model_class.new(self.permitted_params)

    # TODO unify with how the factories create model instances
    @model_instance.build_proposal(flow: 'linear', requester: current_user)

    if self.errors.empty?
      @model_instance.save
      proposal = @model_instance.proposal
      self.initial_attachments(proposal)
      self.add_approvals()
      Dispatcher.deliver_new_proposal_emails(proposal)

      flash[:success] = "Proposal submitted!"
      redirect_to proposal
    else
      flash[:error] = errors
      render 'form'
    end
  end

  def edit
    render 'form'
  end

  def update
    @model_instance.assign_attributes(self.permitted_params)   # don't hit db yet
    if !self.attribute_changes? && self.errors.empty?
      flash[:success] = "No changes were made to the request"
      redirect_to proposal_path(@model_instance.proposal)
    elsif self.errors.empty?
      @model_instance.save
      flash[:success] = "Successfully modified!"
      redirect_to proposal_path(@model_instance.proposal)
    else
      flash[:error] = self.errors
      render 'form'
    end
  end


  protected

  def attribute_changes?
    !@model_instance.changed_attributes.blank?
  end

  def find_model_instance
    @model_instance ||= self.model_class.find(params[:id])
  end

  def proposal
    self.find_model_instance.proposal
  end

  def errors
    @model_instance.validate
    @model_instance.errors.full_messages
  end

  def auth_errors(exception)
    url = polymorphic_url(self.model_class, action: :new, routing_type: :path)
    redirect_to url, alert: exception.message
  end

  def initial_attachments(proposal)
    files = params.permit(attachments: [])[:attachments] || []
    files.each do |file|
      Attachment.create(proposal: proposal, user: current_user, file: file)
    end
  end

  # Hook for adding additional approvers
  def add_approvals
  end
end

I don't think you need to authorize `self.model_class.new` separately due to `authorizing_object`