Rails%203%20In%20Action

Restricting delete access
Just like that, you’re finished restricting updating tickets to only some users.
Now run rake cucumber:ok spec to make sure nothing is broken. Everything
should be good:
31 scenarios (31 passed)
290 steps (290 passed)
# and
24 examples, 0 failures, 10 pending
Fantastic! Let’s commit that:
git add .
git commit -m "Restricting ticket updating to only those who have permission"
git push
Good stuff. In this section, you learned how to restrict the edit and update actions
using the permissions you implemented earlier. There’s one last port of call for this
restricting business: the destroy action.
8.7 Restricting delete access
The final action you restrict is the destroy action in the TicketsController. Again,
you can re-use a feature to test this behavior: the Deleting Tickets feature.
As you did with the Creating Tickets and Updating Tickets features, you implement
a step here in the Deleting Tickets feature to give the user permission to delete tickets.
Under the line that grants users permission to view the TextMate 2 project, put another
one to grant them permission to delete tickets, as shown here:
And "user@ticketee.com" can view the "TextMate 2" project
And "user@ticketee.com" can delete tickets in the "TextMate 2" project
When you run this feature, the whole thing passes because you already have the step
that supports the different permissions you require:
1 scenario (1 passed)
12 steps (12 passed)
This feature ensures that anybody with permission can delete tickets for projects, but
you need another spec to test that anybody without permission is prevented from deleting
tickets.
8.7.1 Enforcing destroy protection
To ensure that users without permission to delete tickets can’t do so, you write a spec
(shown next) directly under the one for the update action in spec/controllers/
tickets_controller_spec.rb:
it "cannot delete a ticket without permission" do
delete :destroy, { :project_id => project.id, :id => ticket.id }
response.should redirect_to(project)
flash[:alert].should eql("You cannot delete tickets from this project.")
end
193