Rails%203%20In%20Action

162 CHAPTER 7 Basic access control
Listing 7.32 app/controllers/admin/users_controller.rb
def destroy
@user.destroy
flash[:notice] = "User has been deleted."
redirect_to admin_users_path
end
When you run bin/cucumber features/deleting_users.feature, the feature passes
because you now have the Delete User link and its matching destroy action:
1 scenario (1 passed)
8 steps (8 passed)
There’s one small problem with this feature, though: it doesn’t stop you from deleting
yourself!
7.8.1 Ensuring you can’t delete yourself
To make it impossible to delete yourself, you must add another scenario to the
deleting_users.feature, shown in the following listing.
Listing 7.33 features/deleting_users.feature
Scenario: Userscannot delete themselves
When I follow "admin@ticketee.com"
And I follow "Delete User"
Then I should see "You cannot delete yourself!"
When you run this feature with bin/cucumber features/deleting_users.feature,
the first two steps of this scenario pass, but the third one fails, as you might expect,
because you haven’t added the message! Change the destroy action in the
Admin::UsersController to the following listing.
Listing 7.34 app/controllers/admin/users_controller.rb
def destroy
if @user == current_user
flash[:alert] = "You cannot delete yourself!"
else
@user.destroy
flash[:notice] = "User has been deleted."
end
redirect_to admin_users_path
end
Now, before the destroy method does anything, it checks to see if the user attempting
to be deleted is the current user and stops it with the "You cannot delete yourself!"
message. When you run bin/cucumber features/deleting_users.feature this time,
the scenario passes:
2 scenarios (2 passed)
16 steps (16 passed)