Rails%203%20In%20Action

Restricting write access
When you run the spec again with bin/rspec spec/controllers/tickets
_controller_spec.rb, it now passes because this user can no longer see this project
and is shown the error:
.
1 example, 0 failures
You scoped the project find for the TicketsController in the same way you did for
the ProjectsController, limiting it to only those projects to which the current user
has access.
That’s the end of that! Now ensure that all your specs and features are passing by
running rake cucumber:ok spec. You should see this output:
31 scenarios (31 passed)
285 steps (285 passed)
# and
20 examples, 0 failures, 10 pending
In this section, you altered the TicketsController so that only users with permission
to access a project can see the tickets inside it. Let’s commit that:
git add .
git commit -m "Restrict reading tickets to correct project scope"
git push
Now let’s add a new permission that restricts who can create tickets in a project.
8.5 Restricting write access
Sometimes when working on a project, you’ll want to limit the creation of tickets to a
certain person or a group of people, such as to only developers or only clients. For
this, you want the New link to be hidden from people who don’t have this permission,
and you need both the new and create actions to reject such users.
8.5.1 Rewriting a feature
You’re lucky to already have the feature for creating tickets, so you just need to add a
step to the Background declaring that the user can create tickets in the project. Place
this step directly under the one declaring that users can view the project. Open
features/creating_tickets.feature, and modify the Background so it contains these two
lines:
And "user@ticketee.com" can view the "Internet Explorer" project
And "user@ticketee.com" can create tickets in the "Internet Explorer" project
When you run bin/cucumber features/creating_tickets.feature, you’re told this
step is undefined:
Given /^"([^"]*)" can create tickets in the "([^"]*)"
➥ project$/ do |arg1, arg2|
pending # express the regexp above with the code you wish you had
end
185