Rails%203%20In%20Action

182 CHAPTER 8 More authorization
This line ensures that you’re always taken to the correct page upon sign-up. Now
replace the code inside app/views/users/confirmation.html.erb with the following
code to make this feature pass again:
You have signed up successfully.
Please confirm your account before signing in.
When users sign up, rather than seeing a confusing page telling them they must be
signed in, they’ll instead see the page shown in figure 8.4.
The Signing Up feature is probably fixed now, but the only true way to make sure
it’s working is to test it manually or to run the feature. Running the feature is easier, so
let’s do that with bin/cucumber features/signing_up.feature:
1 scenario (1 passed)
7 steps (7 passed)
Everything is green. Awesome! This feature is passing again. Let’s make a commit for
that:
git add .
git commit -m "Fix signing up feature,
take user to alternative confirmation page"
Is everything else working, though? Let’s check with rake cucumber:ok spec:
31 scenarios (31 passed)
285 steps (285 passed)
# and
19 examples, 0 failures, 10 pending
Now everything’s working! Let’s push those changes to GitHub:
git push
You’ve limited the ability of users to take action on things inside the Projects-
Controller and fixed the Signing Up feature that broke because of the changes you
made. But you haven’t protected the TicketsController. This is a problem because
users who can’t view a project will still be able to view its tickets, which could pose a
security risk. A project’s most vital assets (for now) are the tickets associated with it,
and users who don’t have permission to see the project shouldn’t be able to see the
associated tickets. Let’s add this restriction next.
Figure 8.4 “Please confirm
your account”