Rails%203%20In%20Action

The projects API
You’re not going to be able to use this same before_filter for your API because the
API doesn’t return flash messages. You have to return errors in a lovely little JSON or
XML format. This particular error, for example, is “You must be an admin.” Also, redirection
doesn’t make sense here, because it wouldn’t tell users why they were redirected.
Therefore, you’ll implement a different authorize_admin! method in your
Api::V1::BaseController instead. You’ll take the time, however, to write a test to
check for this error occurring. Let’s open a new file at spec/api/v1/project
_errors_spec.rb and add a test that if you attempt to make a POST request to api/v1/
projects using a token for a user who’s not an admin, you get an error. Use the code
from the following listing.
Listing 13.11 spec/api/v1/project_errors_spec.rb
require "spec_helper"
describe "Project API errors", :type => :api do
context "standard users" do
let(:user) { create_user! }
it "cannot create projects" do
post "/api/v1/projects.json",
:token => user.authentication_token,
:project => {
:name => "Ticketee"
}
error = { :error => "You must be an admin to do that." }
last_response.body.should eql(error.to_json)
last_response.code.should eql(401)
Project.find_by_name("Ticketee").should be_nil
end
end
end
With this spec, you test that a normal user who’s using a valid authenticity token cannot
create a project through the API because they’re not an admin. Instead, the API
should return a response of “You must be an admin to do that.” This response should
have a code of 401, indicating an Unauthorized response. When you run this spec
using bin/rspec spec/api/v1/project_errors_spec.rb, it will not return the error
as you expect:
expected "{\"error\":\"You must be an admin to do that.\"}"
got "{[project hash]}"
To make this error happen, you’ll go into app/controllers/api/v1/base_controller.rb
and underneath your authenticate_user method add the authorize_admin!
method shown in the following listing.
Listing 13.12 app/controllers/api/v1/base_controller.rb
def authorize_admin!
if !@current_user.admin?
if !@current_user.admin?
363