Rails%203%20In%20Action

Restricting update access
For this feature, at features/editing_tickets.feature, you set up a Permission that
says the user you sign in as has permission to update tickets. To do this, write a step in
the Background directly under the other one that sets up read access, as shown here:
And "user@ticketee.com" can view the "TextMate 2" project
And "user@ticketee.com" can edit tickets in the "TextMate 2" project
When you run bin/cucumber features/editing_tickets.feature, it all passes, just
as you expect. This step covers the scenario in which the user has permission to
update tickets; to cover the scenario in which the user doesn’t have permission, you
need to write a couple of specs first.
8.6.1 No updating for you!
In this section, you restrict updating of tickets in the same way you restricted creating
tickets. You start by writing two examples: one to test the edit action and the other to
test the update action. Inside spec/controllers/tickets_controller_spec.rb, within the
“with permission to view the project” context, define a cannot_update_tickets!
method right under the cannot_create_tickets! method, as shown next:
def cannot_update_tickets!
response.should redirect_to(project)
flash[:alert].should eql("You cannot edit tickets on this project.")
end
Then, underneath the existing examples, put the specs, as shown in the following
listing.
Listing 8.9 Update tests for spec/controllers/tickets_controller_spec.rb
it "cannot edit a ticket without permission" do
get :edit, { :project_id => project.id, :id => ticket.id }
cannot_update_tickets!
end
it "cannot update a ticket without permission" do
put :update, { :project_id => project.id,
:id => ticket.id,
:ticket => {}
}
cannot_update_tickets!
end
These two examples make requests to their respective actions and assert that the user
is redirected away from them with an error message explaining why. With both of
these actions, you need to pass a project_id parameter so the find_project method
can find a project and an id parameter so the find_ticket method can find a ticket.
For the update action, you pass an empty hash so params[:ticket] is set. If you didn’t
do this, you would get a confusing error in your test:
NoMethodError:
undefined method 'stringify_keys' for nil:NilClass
191