Using rights and permissions isn't really any different than doing
anything else. You setup your context, call something and verify that
everything went according to plan. The important thing is always to
try both sides of the coin: when you do have the permission, and when
you dont.
context "Given a user" do
setup do
@user = Factory(:user)
end
context "with the 'download_pdf' permission" do
setup do
@user.authorize :download_pdf
end
context "on GET to :show, :format => 'pdf'" do
setup do
get :show, :format => "pdf"
end
should_respond_with :success
should "provide a PDF for download" do
assert_match /download/, @response.headers["Content-
Disposition"]
end
should "name the PDF" do
assert_match /filename.pdf/, @response.headers["Content-
Disposition"]
end
end
end
context "on GET to :show, :format => 'pdf'" do
setup do
get :show, :format => "pdf"
end
should_respond_with :unauthorized
should_set_the_flash_to /not authorized to download/
end
end
Or something along those lines.
Hope that helps!
--
François Beausoleil
http://blog.teksol.info/
http://piston.rubyforge.org/