diff --git a/app/controllers/projects_controller.rb b/app/controllers/projects_controller.rb index 86548ed..7e95907 100644 --- a/app/controllers/projects_controller.rb +++ b/app/controllers/projects_controller.rb @@ -1,6 +1,7 @@ class ProjectsController < ApplicationController before_action :authenticate_user!, except: [:index, :show] + before_action :check_ownership, only: [:edit, :update, :destroy] # GET /projects/new def new @@ -39,14 +40,7 @@ class ProjectsController < ApplicationController # GET /projects/1/edit # GET /projects/1/edit.json def edit - if current_user.project_ownerships.find_by_project_id(params[:id]).nil? - respond_to do |format| - format.html { redirect_to projects_url, notice: "You shall not edit projects that aren't yours." } - format.json { head :no_content } - end - else - set_project - end + set_project end def update @@ -81,4 +75,13 @@ class ProjectsController < ApplicationController params[:project] end + def check_ownership + if current_user.project_ownerships.find_by_project_id(params[:id]).nil? + respond_to do |format| + format.html { redirect_to projects_url, notice: "You're not allowed to do this operation" } + format.json { head :no_content } + end + end + end + end diff --git a/features/project/edition.feature b/features/project/edition.feature index 561938a..b76b1d1 100644 --- a/features/project/edition.feature +++ b/features/project/edition.feature @@ -27,7 +27,7 @@ Feature: Project And I have a sample project And I am at the All Projects page When I visit the sample project edit page - Then I should see You shall not edit + Then I should see You're not allowed to do this operation @kalibro_restart Scenario: Filling up the form diff --git a/spec/controllers/projects_controller_spec.rb b/spec/controllers/projects_controller_spec.rb index d5e2a0d..c59e184 100644 --- a/spec/controllers/projects_controller_spec.rb +++ b/spec/controllers/projects_controller_spec.rb @@ -72,7 +72,7 @@ describe ProjectsController do it { should render_template(:show) } end - describe 'delete' do + describe 'destroy' do before :each do sign_in FactoryGirl.create(:user) @@ -82,8 +82,12 @@ describe ProjectsController do @ownership = FactoryGirl.build(:project_ownership) @ownership.expects(:destroy) @ownerships = [] + + #Those two mocks looks the same but they are necessary since params[:id] is a String and @project.id is an Integer :( + @ownerships.expects(:find_by_project_id).with("#{@subject.id}").returns(@ownership) @ownerships.expects(:find_by_project_id).with(@subject.id).returns(@ownership) - User.any_instance.expects(:project_ownerships).returns(@ownerships) + + User.any_instance.expects(:project_ownerships).at_least_once.returns(@ownerships) Project.expects(:find).with(@subject.id.to_s).returns(@subject) delete :destroy, :id => @subject.id @@ -136,7 +140,7 @@ describe ProjectsController do end it { should redirect_to(projects_path) } - + it 'should set the flash' do pending("This ShouldaMatcher test is not compatible yet with Rails 4") do should set_the_flash[:notice].to("You shall not edit projects that aren't yours.") @@ -147,7 +151,8 @@ describe ProjectsController do describe 'update' do before do - sign_in FactoryGirl.create(:user) + @user = FactoryGirl.create(:user) + sign_in @user end context 'with valid fields' do @@ -155,6 +160,8 @@ describe ProjectsController do @subject = FactoryGirl.build(:project) @subject_params = Hash[FactoryGirl.attributes_for(:project).map { |k,v| [k.to_s, v.to_s] }] #FIXME: Mocha is creating the expectations with strings, but FactoryGirl returns everything with sybols and integers + FactoryGirl.create(:project_ownership, {user_id: @user.id, project_id: @subject.id}) + Project.expects(:find).with(@subject.id.to_s).returns(@subject) Project.any_instance.expects(:update).with(@subject_params).returns(true) end @@ -185,6 +192,8 @@ describe ProjectsController do @subject = FactoryGirl.build(:project) @subject_params = Hash[FactoryGirl.attributes_for(:project).map { |k,v| [k.to_s, v.to_s] }] #FIXME: Mocha is creating the expectations with strings, but FactoryGirl returns everything with sybols and integers + FactoryGirl.create(:project_ownership, {user_id: @user.id, project_id: @subject.id}) + Project.expects(:find).with(@subject.id.to_s).returns(@subject) Project.any_instance.expects(:update).with(@subject_params).returns(false) -- libgit2 0.21.2