Rails%203%20In%20Action

532 CHAPTER 18 Rack-based applications
Because you’re not too concerned with what happens if an invalid
params[:project_id] or user token is passed through at the moment, you’ll fix those
up after you’ve got this first test passing. With the project now found, you should be
able to display a list of tickets in JSON form in your call method. Let’s change your
root route to return a list of JSON-ified tickets for this project:
get '/' do
@project.tickets.to_json
end
Now your root route should respond with the list of tickets required to have your test
pass. Let’s see if this is the case by running bin/rspec spec/api/v3/json/
tickets_spec.rb:
1 example, 0 failures
Great, this spec is now passing, which means that your Rack application is now serving
a base for version 3 of your API. By making this a Rack application, you can serve
requests in a more lightweight fashion than you could within Rails.
But you don’t have basic error checking in place yet if a user isn’t found matching
a token or if a person can’t find a project. So before you move on, let’s quickly add
tests for these two issues.
18.3.4 Basic error checking
You’ll open spec/api/v3/json/tickets_spec.rb and add two tests inside the describe
block in a new context block, as shown in the following listing.
Listing 18.9 spec/api/v3/json/tickets_spec.rb
context "unsuccessful requests" do
it "doesn't pass through a token" do
get url
last_response.status.should eql(401)
last_response.body.should eql("Token is invalid.")
end
it "cannot access a project that they don't have permission to" do
user.permissions.delete_all
get url, :token => token
last_response.status.should eql(404)
end
end
In the first test you make a request without passing through a token, which should
result in a 401 (unauthorized) status and a message telling you the “Token is invalid.”
In the second test, you use the delete_all association method to remove all permissions
for the user and then attempt to request tickets in a project that the user no longer
has access to. This should result in the response being a 404 response, which
means your API will deny all knowledge of that project and its tickets.