Rails%203%20In%20Action

190 CHAPTER 8 More authorization
This error occurs because you haven’t yet defined a has_many association on the User
model to the Permission model. To do so, open app/models/user.rb and add this line
within the class:
has_many :permissions
This is another case where there’s no reason other than that it makes sense to put it
directly underneath the line for the tickets association. It’s best if you group all similar
methods together. With this association in place, run bin/rspec spec/controllers/
tickets_controller_spec.rb, and the whole spec file passes:
...
3 examples, 0 failures
Great! Now that the spec’s passing, unauthorized users don’t have access to the new
and create actions. How about checking that those who have permissions can access
these actions? Let’s check on the Creating Tickets feature. With this permission
checking in place, any user with the right permissions should still be able to create
tickets. Run bin/cucumber features/creating_tickets.feature to make sure. It
should pass:
3 scenarios (3 passed)
38 steps (38 passed)
Good. Users without permission to create tickets no longer can do so.
Now that you’ve implemented this story, it’s time to commit. As usual, you should
ensure that everything is still working by running rake cucumber:ok spec. Everything
should pass:
31 scenarios (31 passed)
288 steps (288 passed)
# and
22 examples, 0 failures, 10 pending
Let’s commit the changes:
git add .
git commit -m "Restricting creating tickets to only users
➥who have permissions to do it"
git push
In this section, you limited the creation of tickets to only those users who’re granted
permission to do so by using the Permission class and the CanCan gem.
8.6 Restricting update access
You just learned how to restrict access to the creation of tickets; your next step is to
restrict which users can update tickets. Thankfully, you can re-use the framework
that’s already in place with CanCan to make this a cinch. You can also re-use the Editing
Tickets feature to test the restriction.