Rails%203%20In%20Action

184 CHAPTER 8 More authorization
Define this factory now in a new file called factories/ticket_factory.rb. This file will be
automatically loaded by the code in spec/support/factories.rb:
Factory.define :ticket do |ticket|
ticket.title "A ticket"
ticket.description "A ticket, nothing more"
ticket.user { |u| u.association(:user) }
ticket.project { |p| p.association(:project) }
end
Here you set up some defaults for the title and description fields for a factoryprovided
ticket, but you do something new with the user method. You pass a block
and call the association method on the object returned from the block, and the user
for this ticket becomes one user factory-created object. Nifty. You do the same thing
for the project method, so you can create tickets using this factory and have them
related to a project automatically if you want. For this spec, however, you override it.
When you run bin/rspec spec/controllers/tickets_controller_spec.rb
again, this test fails because the user can still access this action:
TicketsController standard users cannot access a ticket for a project
Failure/Error: response.should redirect_to(root_path)
With this test failing correctly, you can work on restricting the access to only the projects
the user has access to. Open app/controllers/tickets_controller.rb and remove the
:except option from the authenticate_user! filter, so it goes from this
before_filter :authenticate_user!, :except => [:index, :show]
to this:
before_filter :authenticate_user!
Now users should always be asked to sign in before accessing the index and show
actions for this controller, meaning that current_user will always return a User object.
You can reference the current_user method in find_project and use the for
method to limit the project find scope to only the projects to which that user has
access. You can change the find_project method to the following example:
def find_project
@project = Project.for(current_user).find(params[:project_id])
rescue ActiveRecord::RecordNotFound
flash[:alert] = "The project you were looking for could not be found."
redirect_to root_path
end
The rewritten find_project method will retrieve a Project only if the current_user
has permission to view that project or is an admin. Otherwise, an ActiveRecord
::RecordNotFound exception will be thrown and rescued here, showing users “The
project you were looking for could not be found.”