Properly scope finders in Question and Choice

Dmitri Garbuzov
1 parent c8450e04
Showing 7 changed files with 51 additions and 41 deletions Show diff stats
app/controllers/choices_controller.rb
app/controllers/questions_controller.rb
app/models/choice.rb
app/models/prompt.rb
app/models/question.rb
spec/integration/choices_spec.rb
spec/integration/questions_spec.rb
@@ -8,7 +8,7 @@ class ChoicesController &lt; InheritedResources::Base
   def index
     if params[:limit]
-      @question = Question.find(params[:question_id])
+      @question = current_user.questions.find(params[:question_id])
       find_options = {:conditions => {:question_id => @question.id},
 		      :limit => params[:limit].to_i, 
@@ -21,7 +21,7 @@ class ChoicesController &lt; InheritedResources::Base
       @choices = Choice.find(:all, find_options)
     else
-      @question = Question.find(params[:question_id], :include => :choices) #eagerloads ALL choices
+      @question = current_user.questions.find(params[:question_id], :include => :choices) #eagerloads ALL choices
       unless params[:include_inactive]
         @choices = @question.choices(true).active.find(:all)
       else
@@ -88,9 +88,16 @@ class ChoicesController &lt; InheritedResources::Base
     # prevent AttributeNotFound error and only update actual Choice columns, since we add extra information in 'show' method
     choice_attributes = Choice.new.attribute_names
     params[:choice] = params[:choice].delete_if {|key, value| !choice_attributes.include?(key)}
+    @question = current_user.questions.find(params[:question_id])
+    @choice = @question.choices.find(params[:id])
     update!
   end
-  
+
+  def show
+    @question = current_user.questions.find(params[:question_id])
+    @choice = @question.choices.find(params[:id])
+    show!
+  end
 end
@@ -55,7 +55,7 @@ class QuestionsController &lt; InheritedResources::Base
   def show
-    @question = Question.find(params[:id])
+    @question = current_user.questions.find(params[:id])
     begin
         @question_optional_information = @question.get_optional_information(params)
@@ -302,9 +302,15 @@ class QuestionsController &lt; InheritedResources::Base
     # prevent AttributeNotFound error and only update actual Question columns, since we add extra information in 'show' method
     question_attributes = Question.new.attribute_names
     params[:question] = params[:question].delete_if {|key, value| !question_attributes.include?(key)}
+    @question = current_user.questions.find(params[:id])
     update!
   end
+  def index
+    @questions = current_user.questions.find(:all)
+    index!
+  end
+
   protected 
 end
@@ -17,6 +17,7 @@ class Choice &lt; ActiveRecord::Base
   after_save :update_questions_counter
   attr_protected :prompts_count, :wins, :losses, :score, :prompts_on_the_right_count, :prompts_on_the_left_count
+  attr_readonly :question_id
   def update_questions_counter
     self.question.update_attribute(:inactive_choices_count, self.question.choices.inactive.length)
@@ -24,6 +24,7 @@ class Prompt &lt; ActiveRecord::Base
   named_scope :ids_only, :select => 'id'
   attr_protected :votes_count, :left_choice_id, :right_choice_id
+  attr_readonly :question_id
   def self.voted_on_by(u)
     select {|z| z.voted_on_by_user?(u)}
@@ -27,6 +27,8 @@ class Question &lt; ActiveRecord::Base
   attr_protected :votes_count, :inactive_choices_count, :choices_count,
                  :active_items_count, :prompts_count
+  attr_readonly :site_id
+
   def create_choices_from_ideas
     if ideas && ideas.any?
       ideas.each do |idea|
@@ -120,17 +120,16 @@ describe &quot;Choices&quot; do
     context "when trying to access another site's choices" do
       before do
-        @other_user = Factory(:email_confirmed_user)
-        @other_question = Factory.create(:aoi_question, :site => @other_user)
-        5.times{ Factory.create(:choice, :question => @other_question) }
+        @orig_user = @api_user
+        @api_user = Factory(:email_confirmed_user)
       end
       it "should fail" do
-        pending("user scope") do
-          get_auth question_choices_path(@question, :format => 'xml'), :offset => 2, :limit => 4
-          response.should_not be_success
-        end
+        get_auth question_choices_path(@question, :format => 'xml'), :offset => 2, :limit => 4
+        response.should_not be_success
       end
+
+      after { @api_user = @orig_user }
     end
   end
@@ -156,10 +155,8 @@ describe &quot;Choices&quot; do
       end
       it "should fail" do
-        pending("user scope") do
-          get_auth question_choice_path(@other_question, @other_choice, :format => 'xml')
-          response.should_not be_success
-        end
+        get_auth question_choice_path(@other_question, @other_choice, :format => 'xml')
+        response.should_not be_success
       end
     end
@@ -185,11 +182,9 @@ describe &quot;Choices&quot; do
       end
       it "should fail" do
-        pending("user scope") do
-          params = { :choice => { :data => "foo" } }
-          put_auth question_choice_path(@question, @choice, :format => 'xml'), params
-          response.should_not be_success
-        end
+        params = { :choice => { :data => "foo" } }
+        put_auth question_choice_path(@question, @choice, :format => 'xml'), params
+        response.should_not be_success
       end
       after { @api_user = @orig_user }
@@ -13,14 +13,18 @@ describe &quot;Questions&quot; do
       response.should be_success
     end
-    it "should not return the questions of other api users" do
-      pending ("doesn't scope to the level of the user") do
-        other_user = Factory(:email_confirmed_user)
-        Factory.create(:aoi_question, :site => other_user)
-        get_auth questions_path
+    context "when calling index as another user" do
+      before do
+        @orig_user = @api_user
+        @api_user = Factory(:email_confirmed_user)
+      end
+      
+      it "should not return the questions of the original user" do
+        get_auth questions_path(:format => 'xml')
         response.should be_success
         response.body.should_not have_tag("question")
       end
+      after { @api_user = @orig_user }
     end
   end
@@ -135,20 +139,18 @@ describe &quot;Questions&quot; do
       end
     end
-    context "GET 'show' trying to view others sites' questions"
+    context "GET 'show' trying to view others sites' questions" do
       before do
         @orig_user = @api_user
         @api_user = Factory(:email_confirmed_user)
       end
-    it "should fail" do
-      pending("user scope") do
+      it "should fail" do
         get_auth question_path(@question, :format => 'xml')
         response.should_not be_success
       end
+      after { @api_user = @orig_user }
     end
-
-    after { @api_user = @orig_user }
   end
   describe "PUT 'update'" do
@@ -166,12 +168,10 @@ describe &quot;Questions&quot; do
     end
     it "should not be able to change the site id" do
-      pending("needs attr_protected") do
-        original_site_id = @question.site_id
-        params = { :question => { :site_id => -1 } }
-        put_auth question_path(@question, :format => 'xml'), params
-        @question.reload.site_id.should == original_site_id
-      end
+      original_site_id = @question.site_id
+      params = { :question => { :site_id => -1 } }
+      put_auth question_path(@question, :format => 'xml'), params
+      @question.reload.site_id.should == original_site_id
     end
     it "should ignore protected attributes" do
@@ -188,11 +188,9 @@ describe &quot;Questions&quot; do
       end
       it "should fail" do
-        pending("user scope") do
-          params = { :question => { :name => "foo" } }
-          put_auth question_path(@question, :format => 'xml'), params
-          response.should_not be_success
-        end
+        params = { :question => { :name => "foo" } }
+        put_auth question_path(@question, :format => 'xml'), params
+        response.should_not be_success
       end
       after { @api_user = @orig_user }
	@@ -17,6 +17,7 @@ class Choice < ActiveRecord::Base		@@ -17,6 +17,7 @@ class Choice < ActiveRecord::Base
17	after_save :update_questions_counter	17	after_save :update_questions_counter
18		18
19	attr_protected :prompts_count, :wins, :losses, :score, :prompts_on_the_right_count, :prompts_on_the_left_count	19	attr_protected :prompts_count, :wins, :losses, :score, :prompts_on_the_right_count, :prompts_on_the_left_count
		20	+ attr_readonly :question_id
20		21
21	def update_questions_counter	22	def update_questions_counter
22	self.question.update_attribute(:inactive_choices_count, self.question.choices.inactive.length)	23	self.question.update_attribute(:inactive_choices_count, self.question.choices.inactive.length)
	@@ -24,6 +24,7 @@ class Prompt < ActiveRecord::Base		@@ -24,6 +24,7 @@ class Prompt < ActiveRecord::Base
24	named_scope :ids_only, :select => 'id'	24	named_scope :ids_only, :select => 'id'
25		25
26	attr_protected :votes_count, :left_choice_id, :right_choice_id	26	attr_protected :votes_count, :left_choice_id, :right_choice_id
		27	+ attr_readonly :question_id
27		28
28	def self.voted_on_by(u)	29	def self.voted_on_by(u)
29	select {\|z\| z.voted_on_by_user?(u)}	30	select {\|z\| z.voted_on_by_user?(u)}