Rails%203%20In%20Action

362 CHAPTER 13 Designing an API
This should be all that you need in order to get your spec to pass, so let’s see what
happens when you run bin/rspec spec/api/v1/projects_spec.rb:
3 examples, 0 failures
Great! Now you need to write a test to check that when you attempt to pass through a
project with no name you’re given a 422 status code and an error along with it, indicating
that the project wasn’t created due to those errors. Directly underneath the
previous test in spec/api/v1/projects_spec.rb, you’ll add this test shown in the following
listing.
Listing 13.10 spec/api/v1/projects_spec.rb
it "unsuccessful JSON" do
post "#{url}.json", :token => token,
:project => {}
last_response.status.should eql(422)
errors = {"name" => ["can't be blank"]}.to_json
last_response.body.should eql(errors)
end
Naughty you, writing the test after the code is already there, but you can get away with
it once. Let’s run the spec and see how it goes now:
4 examples, 0 failures
Great success! With this URL working for valid and non-valid projects appropriately,
you are now providing a way for your users to create a project through the API, and so
it’s time to make a commit:
git add .
git commit -m "Added API to create projects"
git push
Your next task is to restrict this action to only the admins of your application, as in the
real ProjectsController controller. You want to limit the number of people who can
change the projects to a select few who know what they’re doing.
13.1.7 Restricting access to only admins
In app/controllers/projects_controller.rb you’ve got this line, which restricts some
actions to only admins:
before_filter :authorize_admin!, :except => [:index, :show]
As it says on the line, every action other than index or show has this filter run before
it. This filter is defined in app/controllers/application_controller.rb like this:
def authorize_admin!
authenticate_user!
unless current_user.admin?
flash[:alert] = "You must be an admin to do that."
redirect_to root_path
end
end