Rails%203%20In%20Action

The projects API
Then you’ll put this line under the authorize_admin! filter inside this controller’s
class:
before_filter :find_project, :only => [:show]
Next, you need to add the find_project after the show action as a private method, as
shown in the following listing.
Listing 13.16 app/controllers/api/v1/projects_controller.rb
private
def find_project
@project = Project.for(current_user).find(params[:id])
rescue ActiveRecord::RecordNotFound
error = { :error => "The project you were looking for " +
"could not be found."}
respond_with(error, :status => 404)
end
Here you respond with the error message and set the status to 404 to tell the user that
the project doesn’t exist. When you run bin/rspec spec/api/v1/project_errors
_spec.rb, your spec will pass:
2 examples, 0 failures
You’re now restricting the projects that a user can access to only the ones they have
permission to view. If the API user doesn’t have the permission, you’ll deny all knowledge
of the project and return a 404 status code. It’s quite grand how this is possible in
such few lines of easy-to-understand code.
You’ll run all the specs now to make sure everything’s rosy with rake spec. You
should see that it’s all green:
40 examples, 0 failures, 12 pending
A nice round number this time. A commit you shall make:
git add .
git commit -m "Restricting projects API show to only users who have
➥permission to view a project"
git push
Currently you’ve got the index, show, and create actions implemented for your controller.
What’s missing? Well, you could say the new, edit, update, and destroy actions
are, but you don’t need the new and edit actions, because this should be handled on
the client side of the API, not the server. It is the client’s duty to present the new and
edit dialogs to the user. Therefore, you only need to implement the update and
destroy methods and then you’re done with this API. So close!
369