Currently, the rspec matcher handles list of actions correctly for to be_able_to case and returns successfully when the user is allowed to perform all the specified actions.

But, it doesn't work correctly for a list of actions for the negated cases.

# Ability
can [:read, :create, :update], Account

it { is_expected.to be_able_to([:read, :create], Account.new) }  # Passes when user is allowed to perform both actions (read, create)

it { is_expected.not_to be_able_to([:destroy, :read], Account.new) }  # Passes even though user is allowed to read

The underlying issue is this line

actions.all? { |action| ability.can?(action, *args[1..-1]) }

It will return false when we have some true values and even one false value.

PR fixes the issue by making use of => https://relishapp.com/rspec/rspec-expectations/docs/custom-matchers/define-a-custom-matcher#matcher-with-separate-logic-for-expect().to-and-expect().not-to