通过直接before_action无法正常工作的Pundit skip_authorization

class UsersController < ApplicationController
  before_action :set_user, except: [:index, :new, :create]
  before_action :authorize_user, except: [:index, :new, :create]
  
  def index
    @users = policy_scope(User)
  end

  def show
    authorize @user
  end

  def new
    @user = User.new
    skip_authorization # 跳过权限验证
  end

  def create
    @user = User.new(user_params)
    skip_authorization # 跳过权限验证

    if @user.save
      redirect_to @user
    else
      render 'new'
    end
  end

  def edit
    # 没有显式调用 `authorize` 方法
  end

  def update
    authorize @user

    if @user.update(user_params)
      redirect_to @user
    else
      render 'edit'
    end
  end

  def destroy
    authorize @user
    @user.destroy

    redirect_to users_path
  end

  private

  def set_user
    @user = User.find(params[:id])
  end

  def authorize_user
    authorize @user
  end

  def user_params
    params.require(:user).permit(:name, :email, :password)
  end
end