Rails%203%20In%20Action

226 CHAPTER 9 File uploading
you haven’t yet defined the has_attached_file in the Asset model, right? Yup, you
should do that!
Open app/models/asset.rb, and add this line:
has_attached_file :asset
Remove the same line from app/models/ticket.rb because you no longer need it. Having
this has_attached_file defined in the Asset model is probably all you need.
You’ve had all three file fields displaying, and now you’ve got your Asset model set up
to receive these files. When you run the scenario again using bin/cucumber features
/creating_tickets.feature:38, it all passes:
1 scenario (1 passed)
18 steps (18 passed)
Hooray, the scenario passed! In this section, you set up the form that creates new
Ticket objects to also create three associated Asset objects by using nested attributes.
This process was made possible by moving the responsibility of handling file uploads
out of the Ticket model and into the associated Asset model.
Let’s ensure that nothing is broken by running rake cucumber:ok spec:
46 scenarios (46 passed)
470 steps (470 passed)
# and
21 examples, 0 failures, 4 pending
Awesome, let’s commit and push this:
git add .
git commit -m "Users can now upload 3 files at a time"
git push
Great. You’re done with nested attributes! Earlier, it was mentioned that the files
uploaded to your application are publicly available for anybody to access because
these files are in the public directory. Any file in the public directory is served up automatically
by any Rails server, bypassing all the authentication and authorization in
your application. This is a bad thing. What if one of the projects in your application
has files that should be accessed only by authorized users?
9.3 Serving files through a controller
You can solve this issue by serving the uploaded files through a controller for your
application. Using a before_filter similar to the one you used previously in the
TicketsController, this controller will check that the user attempting to access a file
has permission to access that particular project.
When you implemented permission behavior before, you ensured that any unauthorized
user would be blocked from accessing the resource you were trying to protect
by writing a controller spec. You write this same kind of spec test for serving files.