Rails%203%20In%20Action

8.4 Blocking access to tickets
Blocking access to tickets
When implementing permissions, you have to be careful to ensure that all users who
should have access to something do, and all users who shouldn’t have access to something
don’t. All of the TicketsController’s actions are still available to all users
because it has no permission checking. If you leave it in that state, users who are
unable to see the project can still make requests to the actions inside Tickets-
Controller. They shouldn’t be able to do anything to the tickets in a project if they
don’t have permission to view tickets for it. Let’s implement permission checking to
remedy this problem.
8.4.1 Locking out the bad guys
To prevent users from seeing tickets in a project they’re unauthorized to see, you must
lock down the show action of TicketsController.
To test that when you put this restriction in place, it’s correct, write a spec in the
spec/controllers/tickets_controller_spec.rb file, just as you did for the Projects-
Controller. This file should now look like the following listing.
Listing 8.5 spec/controllers/tickets_controller_spec.rb
require 'spec_helper'
describe TicketsController do
let(:user) { create_user! }
let(:project) { Factory(:project) }
let(:ticket) { Factory(:ticket, :project => project,
:user => user) }
context "standard users" do
it "cannot access a ticket for a project" do
sign_in(:user, user)
get :show, :id => ticket.id, :project_id => project.id
response.should redirect_to(root_path)
flash[:alert].should eql("The project you were looking for could not be
found.")
end
end
end
This test sets up a project, a ticket, and a user who has no explicit permission to view
the project and therefore shouldn’t be able to view the ticket. You test this spec by
signing in as the unauthorized user and trying to go to the show action for this ticket,
which requires you to pass through a project_id to help it find what project the
ticket is in. The test should pass if the user is redirected to the root_path and if, upon
the user seeing the flash[:alert], the application denies all knowledge of this project
ever having existed.
When you run this test using bin/rspec spec/controllers/tickets_controller
_spec.rb, you see the ticket factory is undefined:
No such factory: ticket (ArgumentError)
183