Rails%203%20In%20Action

Restricting delete access
Listing 8.11 features/hidden_links.feature
Scenario: New ticket link is shown to a user with permission
Given "user@ticketee.com" can view the "TextMate 2" project
And "user@ticketee.com" can create tickets on the "TextMate 2" project
And I am signed in as "user@ticketee.com"
When I follow "TextMate 2"
Then I should see "New Ticket"
Scenario: New ticket link is hidden from a user without permission
Given "user@ticketee.com" can view the "TextMate 2" project
And I am signed in as "user@ticketee.com"
When I follow "TextMate 2"
Then I should not see the "New Ticket" link
Scenario: New ticket link is shown to admins
Given I am signed in as "admin@ticketee.com"
When I follow "TextMate 2"
Then I should see the "New Ticket" link
These three scenarios test all three permutations of users who could possibly see this
page. Users with permission and admins should be able to see the link, and users without
permission should not. When you run this feature with bin/cucumber features/
hidden_links.feature, the second scenario fails:
Expected to not see the "New Ticket" link, but did.
(RSpec::Expectations::ExpectationNotMetError)
This error occurs because the link is visible independently of whether or not the user
has permission. With these scenarios in place, you can work on making them pass. You
can wrap the New Ticket in a helper method, similar to the admins_only helper used
in chapter 6. Open app/views/projects/show.html.erb, and change the New Ticket link
from this
to this:
Currently, this authorized? method is undefined. This is the method you need in
views all across your application to determine if the user has permission to see the specific
action and if that user is an admin. Because you’ll use this helper everywhere,
define it inside app/helpers/application_helper.rb, as shown here:
def authorized?(permission, thing, &block)
block.call if can?(permission.to_sym, thing) ||
current_user.try(:admin?)
nil
end
This helper uses CanCan’s can? method to check if the user is authorized to perform
this action. If so, then all is fine and dandy. If not, then you check to see if the
195