Rails%203%20In%20Action

Restricting actions to admins only
Scenario: Delete project link is hidden for non-signed-in users
Given I am on the homepage
When I follow "TextMate 2"
Then I should not see the "Delete Project" link
Scenario: Delete project link is hidden for signed-in users
Given I am signed in as "user@ticketee.com"
When I follow "TextMate 2"
Then I should not see the "Delete Project" link
Scenario: Delete project link is shown to admins
Given I am signed in as "admin@ticketee.com"
When I follow "TextMate 2"
Then I should see the "Delete Project" link
To make these steps pass, change the ProjectsController’s show template to wrap
these links in the admins_only helper, as shown in the next listing.
Listing 7.15 app/views/projects/show.html.erb
:delete,
:confirm => "Are you sure you want to delete this project?" %>
When you run this entire feature using bin/cucumber features/hidden_links
.feature, all the steps should pass:
9 scenarios (9 passed)
42 steps (42 passed)
All right, that was a little too easy! But that’s Rails.
This is a great point to ensure that everything is still working by running rake
cucumber:ok spec. According to the following output, it is:
25 scenarios (25 passed)
200 steps (200 passed)
# and
11 examples, 0 failures, 5 pending
Let’s commit and push that:
git add .
git commit -
m "Lock down specific projects controller actions for admins only"
git push
In this section, you ensured that only users with the admin attribute set to true can get
to specific actions in your ProjectsController as an example of basic authorization.
Next, you learn to “section off” part of your site using a similar methodology and
explore the concept of namespacing.
147