Rails%203%20In%20Action

Restricting write access
This feature will pass whether the user has permission to create a ticket or not. You’re
now basically in the same situation you faced with the Viewing Tickets feature: the feature
would pass either way. So, just like before, you use RSpec to test that users can’t
create a ticket if they don’t have permission to do so.
8.5.2 Blocking creation
Let’s write the specs to test that users with permission to view the project but without
permission to create tickets can’t create tickets. Put the specs shown in the following
listing in spec/controllers/tickets_controller_spec.rb inside the standard users context
block so all the examples are grouped nicely.
Listing 8.7 spec/controllers/tickets_controller_spec.rb
context "with permission to view the project" do
before do
sign_in(:user, user)
Permission.create!(:user => user, :thing => project, :action => "view")
end
def cannot_create_tickets!
response.should redirect_to(project)
flash[:alert].should eql("You cannot create tickets on this project.")
end
it "cannot begin to create a ticket" do
get :new, :project_id => project.id
cannot_create_tickets!
end
it "cannot create a ticket without permission" do
post :create, :project_id => project.id
cannot_create_tickets!
end
end
You first set up the specs using a before, signing in as a user, and defining a permission
for that user to view the project. Next, you define a method called cannot
_create_tickets! asserting that unauthorized users should be redirected to the project
and shown an alert stating they’re not allowed to create tickets. Rather than duplicating
these two lines in each spec where you want to check that a user receives the
correct message, you just call the cannot_create_tickets! method in that place. The
two examples you just added ensure that unauthorized visitors to the new and create
actions can’t create tickets.
When you run this file with bin/rspec spec/controllers/tickets_controller
_spec.rb, the specs fail, just as you might expect:
Failure/Error: response.should redirect_to(project)
Expected response to be a , but was
187