Rails%203%20In%20Action

Restricting actions to admins only
changes. To fix this problem, use RSpec.configure in another file: spec/support/
devise.rb. RSpec automatically loads files in this directory. Let’s create this file now and
fill it with the content from the following listing.
Listing 7.6 spec/support/devise.rb
RSpec.configure do |config|
config.include Devise::TestHelpers
end
You should include this module only for controller tests by passing a filter to the end:
config.include Devise::TestHelpers, :type => :controller
If you don’t restrict where this module is included, it could lead to problems further
down the line. It’s better to be safe than sorry.
TIP You can specify :type => :model as a filter if you want to include a
module only in your model specs. If you ever write any view specs, you can
use :type => :view to include this module only in the view specs. Similarly,
you can use :controller for controller specs.
Going back to your spec, you make a request on the third line to the new action in the
controller. The before_filter that you haven’t yet implemented should catch the
request before it gets to the action; it won’t execute the request but instead redirects
the user to root_path and shows a flash[:alert] saying the user “must be an admin
to do that.”
If you run this spec with bin/rspec spec/controllers/projects_controller
_spec.rb, it fails as you expect:
Failure/Error: response.should redirect_to(root_path)
Expected response to be a , but was
This error message tells you that although you expected to be redirected, the
response was actually a 200 response, indicating a successful response. This isn’t what
you want. Now let’s get it to pass.
The first step is to define a new method that checks whether a user is an admin,
and if not, displays the “You must be an admin to do that” message and then redirects
the requester to the root_path. First define this new method inside app/controllers/
application_controller.rb, which is the base class for all controllers and makes any
methods defined here available to all controllers. Define the method using the following
listing inside the ApplicationController class.
Listing 7.7 app/controllers/application_controller.rb
private
def authorize_admin!
authenticate_user!
unless current_user.admin?
141