Rails%203%20In%20Action

138 CHAPTER 7 Basic access control
When you run this feature, it can’t find the admin field for your users table,
because you haven’t added it yet:
Given there are the following users:
| email | password | admin |
| admin@ticketee.com | password | true |
undefined method `admin=’ for #
7.2 Adding the admin field to the users table
You can generate a migration to add the admin field by running rails generate
migration add_admin_to_users admin:boolean. You want to modify this migration so
that when users are created, the admin field is set to false rather than defaulting to
nil. Open the freshly generated migration and change this line
add_column :users, :admin, :boolean
to this:
add_column :users, :admin, :boolean, :default => false
When you pass in the :default option here, the admin field defaults to false, ensuring
that users aren’t accidentally created as admins.
The command rake db:migrate db:test:prepare runs the migration, adds the
admin field to the users table, and sets up the test database. Now you see that the step
is passing:
Given there are the following users:
| email | password | admin |
| admin@ticketee.com | password | true |
With this step definition implemented, run rake cucumber:ok and rake spec to make
sure you haven’t broken anything. According to this output, you haven’t:
16 scenarios (16 passed)
152 steps (152 passed)
Great! Now you can go about restricting the acts of creating, updating, and destroying
projects to only those users who are admins.
7.3 Restricting actions to admins only
For this step, you implement a before_filter that checks not only whether the user
is signed in but also whether the user is an admin.
Before you write this before_filter, you write a controller spec rather than a
Cucumber feature to test it. Cucumber features are great for defining a set of actions
that a user can perform in your system, but controller specs are much better for
quickly testing singular points, such as whether or not a user can go to a specific
action in the controller. You used this same reasoning back in chapter 4 to test what
happens when a user attempts to go to a project that doesn’t exist.
You want to ensure that all visits to the new, create, edit, update, and destroy
actions are done by admins and are inaccessible to other users. Open spec/controllers/