Rails%203%20In%20Action

148 CHAPTER 7 Basic access control
7.4 Namespace routing
Although it’s fine and dandy to ensure that admin users can get to special places in
your application, you haven’t yet added the functionality for triggering whether or not
a user is an admin from within the application itself. To do so, you create a new
namespaced section of your site called admin. The purpose of namespacing in this case
is to separate a controller from the main area of the site so you can ensure that users
accessing this particular controller (and any future controllers you create in this
namespace) have the admin field set to true.
You begin by generating a namespaced controller with an empty index action by
using this command:
rails g controller admin/users index
When the / separator is used between parts of the controller, Rails knows to generate
a namespaced controller called Admin::UsersController at app/controllers/admin/
users_controller.rb. The views for this controller are at app/views/admin/users, and
the spec is at spec/controllers/admin/users_controller_spec.rb.
This command also inserts a new route into your config/routes.rb file. You don’t
want that, so remove this line:
get "users/index"
Now you must write a spec for this newly generated controller to ensure only users
with the admin attribute set to true can access it. Open spec/controllers/admin/
users_controller_spec.rb and write an example to ensure non-signed-in users can’t
access the index action, as shown in the following listing.
Listing 7.16 spec/controllers/admin/users_controller_spec.rb
require 'spec_helper'
describe Admin::UsersController do
let(:user) do
user = Factory(:user)
user.confirm!
user
end
context "standard users" do
before do
sign_in(:user, user)
end
it "are not able to access the index action" do
get 'index'
response.should redirect_to(root_path)
flash[:alert].should eql("You must be an admin to do that.")
end
end
end