Acceptance tests for project's edit action

Guilherme Rojas V. de Lima · Guilherme Rojas
1 parent f2e23359
Showing 3 changed files with 28 additions and 4 deletions Show diff stats
app/controllers/projects_controller.rb
features/project/edition.feature
features/step_definitions/project_steps.rb
@@ -39,6 +39,12 @@ class ProjectsController &lt; ApplicationController
   # GET /projects/1/edit
   # GET /projects/1/edit.json
   def edit
+    if current_user.project_ownerships.find_by_project_id(params[:id]).nil?
+      respond_to do |format|
+        format.html { redirect_to projects_url, notice: "You shall not edit projects that aren't yours." }
+        format.json { head :no_content }
+      end
+    end
     set_project
   end 
@@ -21,6 +21,15 @@ Feature: Project
     Then I should not see Edit
   @kalibro_restart
+  Scenario: Should not render the edit page if the project doesn't belongs to the current user
+    Given I am a regular user
+    And I am signed in
+    And I have a sample project
+    And I am at the All Projects page
+    When I visit the sample project edit page
+    Then I should see You shall not edit
+
+  @kalibro_restart
   Scenario: Filling up the form
     Given I am a regular user
     And I am signed in
@@ -34,7 +43,7 @@ Feature: Project
   Scenario: With valid attributes
     Given I am a regular user
     And I am signed in
-    And I have a sample project
+    And I own a sample project
     And I am at the sample project edit page
     And I fill the Name field with "Kalibro"
     And I fill the Description field with "Web Service to collect metrics"
@@ -47,7 +56,7 @@ Feature: Project
     Given I am a regular user
     And I am signed in
     And I have a project named "Qt-Calculator"
-    And I have a project named "Kalibro"
+    And I own a project named "Kalibro"
     And I am at the sample project edit page
     And I fill the Name field with "Qt-Calculator"
     When I press the Update button
@@ -57,7 +66,7 @@ Feature: Project
   Scenario: Editing just the description
     Given I am a regular user
     And I am signed in
-    And I have a sample project
+    And I own a sample project
     And I am at the sample project edit page
     And I fill the Description field with "Web Service to collect metrics"
     When I press the Update button
@@ -67,7 +76,7 @@ Feature: Project
   Scenario: With blank project name
     Given I am a regular user
     And I am signed in
-    And I have a sample project
+    And I own a sample project
     And I am at the sample project edit page
     And I fill the Name field with " "
     When I press the Update button
@@ -17,6 +17,11 @@ Given(/^I own a sample project$/) do
   FactoryGirl.create(:project_ownership, {user_id: @user.id, project_id: @project.id})
 end
+Given(/^I own a project named "(.*?)"$/) do |name|
+  @project = FactoryGirl.create(:project, {id: nil, name: name})
+  FactoryGirl.create(:project_ownership, {user_id: @user.id, project_id: @project.id})
+end
+
 Given(/^I am at the Sample Project page$/) do
   visit project_path(@project.id)
 end
@@ -25,6 +30,10 @@ Given(/^I am at the sample project edit page$/) do
   visit edit_project_path(@project.id)
 end
+Given(/^I visit the sample project edit page$/) do
+  visit edit_project_path(@project.id)
+end
+
 Given(/^I am at the New Project page$/) do
   visit new_project_path
 end
	@@ -39,6 +39,12 @@ class ProjectsController < ApplicationController		@@ -39,6 +39,12 @@ class ProjectsController < ApplicationController
39	# GET /projects/1/edit	39	# GET /projects/1/edit
40	# GET /projects/1/edit.json	40	# GET /projects/1/edit.json
41	def edit	41	def edit
		42	+ if current_user.project_ownerships.find_by_project_id(params[:id]).nil?
		43	+ respond_to do \|format\|
		44	+ format.html { redirect_to projects_url, notice: "You shall not edit projects that aren't yours." }
		45	+ format.json { head :no_content }
		46	+ end
		47	+ end
42	set_project	48	set_project
43	end	49	end
44		50