Rails%203%20In%20Action

Restricting by scope
response.should redirect_to(projects_path)
flash[:alert].should eql("The project you were looking for could not be fou
nd.")
end
You use the same error message from the missing project spec because you don’t
want to acknowledge to unauthorized users that the project they’re looking for exists
when they don’t have access to read it. When you run this spec using bin/rspec spec
/controllers/projects_controller_spec.rb, it fails:
1) ProjectsController standard users cannot access the show action
Failure/Error: response.should redirect_to(projects_path)
The spec fails because you haven’t yet scoped down the find call in the find_project
method, which is called using a before_filter in ProjectsController.
With a failing spec testing the nonexistent behavior, open app/controllers/
projects_controller.rb and change the find_project method to look for projects that
the current user has access to so your spec will pass. But there’s one problem: you’re
not restricting the show action to only users who are signed in now.
You must make it so that the user has to sign in before accessing the show action
because you need to use the current_user method to check what permissions this
user has access to within the find_project method.
To do so, call the authenticate_user! method as a before_filter in this controller,
just as you did for certain actions in the TicketsController. Place this
method above the find_project to ensure that a user is authenticated before
find_project does its job. The filters in ProjectsController should now look like
the following listing.
Listing 8.4 app/controllers/projects_controller.rb
before_filter :authorize_admin!, :except => [:index, :show]
before_filter :authenticate_user!, :only => [:show]
before_filter :find_project, :only => [:show, :edit, :update, :destroy]
Now alter the find_project method to check the permissions of the project before
letting authorized users see it or refusing unauthorized users access. Change the line
that defines the @project variable from this
@project = Project.find(params[:id])
to this:
@project = Project.readable_by(current_user).find(params[:id])
The readable_by method doesn’t exist yet; you’ll define it in just a moment. The
readable_by method returns a scope of only the projects the user is allowed to view.
This scope has exactly the same methods that an Active Record class has, so you can
treat it just like one. You can define this method using the scope class method in your
Project mode.
169