Rails%203%20In%20Action

9.3.1 Protecting files
Serving files through a controller
You first need to generate the controller through which you’ll serve the assets. Call it
files, because assets is already reserved by Sprockets:
rails g controller files
Now write a spec to ensure that unauthorized users can’t see the files inside it. For this
spec test, you must create two users, a project, a ticket, and an asset. The first user
should have permission to read this project, and the second user shouldn’t.
Open spec/controllers/files_controller_spec.rb, and add let definitions that set up
your users, project, ticket, and asset inside the describe for FilesController, as
shown in the following listing.
Listing 9.8 spec/controllers/files_controller_spec.rb
describe FilesController do
let(:project) { Factory(:project) }
let(:ticket) { Factory(:ticket, :project => project) }
let(:good_user) { create_user! }
let(:bad_user) { create_user! }
let(:path) { Rails.root + "spec/fixtures/speed.txt" }
let(:asset) do
ticket.assets.create(:asset => File.open(path))
end
before do
good_user.permissions.create!(:action => "view",
:thing => project)
end
end
You used a let for setting up a project, two users, a ticket for this project, a path to the
file that’s served from the controller, and the asset for the ticket. This is the asset you’ll
be serving from the controller for this spec test.
You set up the permission in a before block because you won’t be referencing it
anywhere in your tests, so having it as a let block wouldn’t work. You should use let
blocks only when you’re going to be referencing them inside your tests. If you need
code set up beforehand, you should use a before block instead.
To serve the files from this controller, use the show action, using the id parameter
to find the asset the user is requesting. When the application finds this asset, you want
it to check that the user requesting the asset has permission to read the project this
asset links to. The good_user object should be able to, and the bad_user object
shouldn’t. Now add the spec to test the good_user’s ability to download this asset by
using the code from the following listing.
Listing 9.9 spec/controllers/assets_controller_spec.rb
context "users with access" do
before do
227