Rails%203%20In%20Action

356 CHAPTER 13 Designing an API
In the before block you create one project that the user should not have access to
read. Inside the test itself, you’re still using the for scope on the Project class to get
only the projects that the specified user has access to. Let’s add a couple more lines to
your example now to check that this user cannot see the Access Denied project:
projects.any? do |p|
p["project"]["name"] == "Access Denied"
end.should be_false
When you run this spec with bin/rspec spec/api/v1/projects_spec.rb you’ll see
that the JSON returned from your controller still contains both projects:
expected "[[Ticketee hash]]"
got "[[Ticketee hash], [Access Denied hash]]"
To make this test pass, you’re going to need to stop returning all the projects in the
index action of Api::V1::ProjectsController and only return the projects that this
user should be able to see. Let’s now open app/controllers/api/v1/projects
_controller.rb and change the index action to use the for method and pass in the
current_user, rather than the all method:
def index
respond_with(Project.for(current_user))
end
This will now return only the list of projects that the user should be able to see, which
should be enough to get this test passing. You can find out with another quick run of
bin/rspec spec/api/v1/projects_spec.rb:
1 example, 0 failures
Great, now you’ve got your API finding a user based on the token that you’ve gathered
in your spec. One thing you haven’t tested for yet is: what happens when an invalid (or
no) token is given? Well, you should return an error when that happens. This is the
final change you’ll be making before you make a commit, because it’s been a little too
long since you’ve last done that. 8
13.1.4 Error reporting
Something will inevitably go wrong in your application, and when that happens you’re
going to want to provide useful error messages to your users. One of the things that
could go wrong in your API is that the user uses an invalid token to authenticate
against your API. When a user makes a request with an invalid token, you should
inform them of their mistake, which you can do by returning JSON that looks like this:
{ error: "Token is invalid." }
To test this behavior, you’re going to make a request without a token and then fix up
your projects_spec.rb test to pass in a token. You’ll write your first test now in a new
8 As a reminder: you should commit after every safe point so that if you stuff something up (it happens!) you
won’t have to roll back as much.