Rails%203%20In%20Action

198 CHAPTER 8 More authorization
:delete,
:confirm => "Are you sure you want to delete this ticket?" %>
When you run bin/cucumber features/hidden_links.feature, all 15 scenarios pass:
16 scenarios (16 passed)
124 steps (124 passed)
Fantastic! Now you’ve stopped displaying links to the users who shouldn’t see them
and switched to displaying them only to people who should be able to see them.
What a whirlwind adventure! First you learned to check for permissions for all the
actions in the TicketsController, and then you learned to hide links from users in
the views. Let’s make sure everything is working by running rake cucumber:ok spec:
40 scenarios (40 passed)
376 steps (376 passed)
# and
17 examples, 0 failures, 3 pending
Great! Now let’s commit:
git add .
git commit -m "Restrict actions in TicketsController
➥based on permissions and hide links"
git push
With all that done, you now have the scaffold for setting up permissions but no interface
to it! There’s currently no way in the system for a user (in particular, an admin) to
set up the permissions on other users. We now implement that.
8.8 Assigning permissions
In chapter 6, you added an admin field to the users table and then triggered it
through the admin backend by checking or unchecking a check box. You’re going to
do the same thing with the permissions for the projects. When you’re done, you’ll see
a permissions screen that allows you to pick and choose the permissions for the users
and projects.
You implement this screen one check box at a time because you must confirm that
the permissions you assign through this interface work just as well as when you use the
step definitions in Cucumber. Let’s get started with the permission to view projects.
8.8.1 Viewing projects
In this section, you implement the foundations for assigning the permissions through
the admin backend, starting with the permission to view projects. Create a new feature
called features/assigning_permissions.feature, and start it out with the code from the
following listing.