Rails%203%20In%20Action

364 CHAPTER 13 Designing an API
error = { :error => "You must be an admin to do that." }
warden.custom_failure!
render params[:format].to_sym => error
, :status => 401
end
end
end
Here you use warden.custom_failure! to inform Warden (the Rack backend to
Devise) that you’re going to raise a custom 401 response. Without this, Devise would
instead take over from this 401 response, showing a “You must be signed in to continue”
error message.
You also use the render method in a unique manner here. You call it and pass in a
hash with the key being a symbolized version of the format (in this case, json) and the
value being the hash that contains the error. By calling render in this way, Rails will
convert the hash to JSON, or if it were an XML request, to XML. The reason for doing
it this way rather than using respond_with is because respond_with will attempt to do
some weird behavior and doesn’t work for POST requests, so you must work around
that little issue.
By specifying the status option to the render here, your response’s status code
will be set to that particular status, which will let the code used to connect to the API
know that the user is unauthorized to perform the specific request.
Now all you need to do is add this as a before_filter into app/controllers/api/
v1/projects_controller.rb using this line:
before_filter :authorize_admin!, :except => [:index, :show]
With this line in the ProjectsController, any request to any action that’s not the
index or show action will have the admin check run before it. If a user doesn’t meet
this criteria, then you will return the “You must be an admin to do that” error. These
pieces of code should be enough to get your test running, so let’s find out with bin/
rspec spec/api/v1/project_errors_spec.rb:
1 example, 0 failures
Now when people who aren’t admins try to create a project, they will see the “You
must be an admin to do that” error message returned from the API. Because this is the
case, you’ll need to set up the user in the projects API examples to be an admin when
they attempt to create a project, which you can do by putting this before after the
beginning of the “creating a project” context block:
before do
user.admin = true
user.save
end
When you run bin/rspec spec/api/v1/projects_spec.rb, all the examples will be
passing:
4 examples, 0 failures