Rails%203%20In%20Action

284 CHAPTER 10 Tracking state
it "cannot transition a state by passing through state_id" do
post :create, { :comment => { :text => "Hacked!",
:state_id => state.id },
:ticket_id => ticket.id }
ticket.reload
B Reload Ticket object
ticket.state.should eql(nil)
end
end
This spec uses a before to sign in as the user before the example runs. Inside the
example, you use the post method to make a POST request to the create action
inside CommentsController, passing in the specified parameters. It’s this state_id
parameter that should be ignored in the action.
After the post method, you use a new method :reload B. When you call reload
on an Active Record object, it will fetch the object again from the database and update
the attributes for it. You use this because the create action acts on a different Ticket
object and doesn’t touch the one you’ve set up for your spec.
The final line here asserts that the ticket.state should be nil. When you run
this spec by running bundle exec rspec spec/controllers/comments_controller
_spec.rb, this final line will be the one to fail:
Failure/Error: ticket.state.should eql(nil)
expected nil
got #
The ticket.state is returning a state object because the user has been able to post
it through the parameter hash. With a failing spec now in place, you can go about
stopping this state parameter from going unchecked. To ignore this parameter, you
can remove it from the params hash if the user doesn’t have permission to change
states. At the top of the create action, inside of CommentsController, put the following
lines:
if cannot?(:"change states", @ticket.project)
params[:comment].delete(:state_id)
end
This code will remove the state_id key from the params[:comment] hash if the user
doesn’t have permission to change the states on the ticket’s project, thereby preventing
them from being able to change the state. If you rerun your spec using bin/rspec spec
/controllers/comments_controller_spec.rb, you’ll see that it passes:
1 example, 0 failures
Great! Now nobody without permission will be able to download the ticket page, make
modifications to it to add a state field, and then be able to change the states.
You’re done with this feature now so it’s time to make sure you didn’t break anything
with your changes by running rake cucumber:ok spec. You should see that
everything is squeaky clean: