Rails%203%20In%20Action

194 CHAPTER 8 More authorization
You don’t have to put the last two lines in their own method because you won’t use
them more than once. When you run this spec, it fails on the final line rather than on
the third line:
1) TicketsController standard users with permission to view the project
cannot delete a ticket without permission
Failure/Error: flash[:alert].should eql
➥("You cannot delete tickets from this project.")
This error occurs because the destroy action is actually being processed, and it redirects
the user to the project once it’s complete. The spec doesn’t know the difference
between a redirect from within the action or within the before_filter, nor should it.
To make this spec pass, define a new method called authorize_delete! at the bottom
of the TicketsController:
def authorize_delete!
if !current_user.admin? && cannot?(:"delete tickets", @project)
flash[:alert] = "You cannot delete tickets from this project."
redirect_to @project
end
end
Then you can call this method in a before_filter too:
before_filter :authorize_delete!, :only => :destroy
When you run this spec using bin/rspec spec/controllers/tickets_controller
_spec.rb, it’s all passing:
6 examples, 0 failures
Now that you’re stopping users without permission, how goes your feature? Run bin/
cucumber features/deleting_tickets.feature to find out:
1 scenario (1 passed)
12 steps (12 passed)
Great! With this last permission in place, all the actions in the TicketsController are
restricted to their appropriate users. Let’s make a commit:
git add .
git commit -m "Restrict destroy action to only people with permission"
git push
Because the controller’s actions are restricted, the links associated with these actions
should be hidden from users who are unable to perform these actions.
8.7.2 Hiding links based on permission
To ensure that these links are hidden from those who shouldn’t be able to see them
but are still visible to admins (because admins should be able to do everything), you
use features/hidden_links.feature. Start with the New Ticket link by adding the scenarios
from the following listing.