Rails%203%20In%20Action

142 CHAPTER 7 Basic access control
flash[:alert] = "You must be an admin to do that."
redirect_to root_path
end
end
This method uses the authenticate_user! method (provided by Devise) to ensure
that the user is signed in. If the user isn’t signed in when this method is called, they’re
asked to sign in. If the user isn’t an admin after signing in, they’re shown the “You
must be an admin to do that” message and redirected to the homepage.
To call this method, call before_filter at the top of your ProjectsController, as
shown in the following listing.
Listing 7.8 app/controllers/projects_controller.rb
before_filter :authorize_admin!, :except => [:index, :show]
With that in place, you can rerun the spec bin/rspec spec/controllers/projects
_controller_spec.rb, which should now pass:
2 examples, 0 failures
Great, now you know this is working for the new action, but does it work for create,
edit, update, and destroy? You can replace the "cannot access the new action"
example you just wrote with the code from the following listing.
Listing 7.9 spec/controllers/projects_controller_spec.rb
{ "new" => "get",
"create" => "post",
"edit" => "get",
"update" => "put",
"destroy" => "delete" }.each do |action, method|
it "cannot access the #{action} action" do
sign_in(:user, user)
send(method, action.dup, :id => project.id)
response.should redirect_to(root_path)
flash[:alert].should eql("You must be an admin to do that.")
end
end
In this example, you use a project variable, which you need to set up by using a let,
as you did for user. Under the let for user, add one for project:
let(:project) { Factory(:project) }
The attributes of this project object are unimportant: you only need a valid object,
and Factory Girl provides that for you.
The keys for the hash on the first line of listing 7.9 contain all the actions you want
to ensure are protected; the values are the methods you use to make the request to
the action. You use the action here to give your examples dynamic names, and you use
them further down when you use the send method. The send method allows you to
dynamically call methods and pass arguments to them. It’s used here because for each