Как переделать тесты с учетом cancan, чтобы создавать/редактировать Airport мог только пользователь с ролью robot и admin, а удалять только пользователь с ролью admin?
Сам Airport что-то типа справочника и ассоциаций с User не имеет
Сейчас response.body содержит error: You are not authorized to access this
page.
Собственно вопрос как мне в тестах сделать запрос от пользователя с нужной ролью
Есть Ability
if user.admin?
can :manage, :all
elsif user.robot?
can [:read, :search, :create, :update], Flight
can [:read, :create, :update], Airport
elsif user.operator?
can [:read, :search], Flight
can :read, Airport
else # not logged in
can [:read, :search], Flight
can :read, Airport
end
есть User
def admin?
self.role == 'admin'
end
def robot?
self.role == 'robot'
end
Есть Spec
describe 'POST /create' do
let(:access_token) { create(:access_token) }
let(:user) { User.find(access_token.resource_owner_id) }
it_behaves_like 'Api Authenticable'
context 'authorized' do
context 'with valid attributes' do
before { post '/api/v1/airports', format: :json, access_token: access_token.token, airport: attributes_for(:airport, :airport_random) }
it 'responses with 201' do
expect(response.status).to eq 201
end
it 'creates new airport' do
expect { response }.to change(Airport, :count).by 1
end
end
context 'with invalid attributes' do
before { post '/api/v1/airports', format: :json, access_token: access_token.token, airport: { name: nil, iata: nil } }
it 'responses with 422' do
expect(response.status).to eq 422
end
it 'doesnt create new airport' do
expect { response }.to_not change(Airport, :count)
end
end
end
def do_request(options = {})
post '/api/v1/airports', { format: :json }.merge(options)
end
end
describe 'PUT /update' do
let(:access_token) { create(:access_token) }
let(:user) { User.find(access_token.resource_owner_id) }
let(:airport) { create(:airport, :airport_random) }
before do
put "/api/v1/airports/#{airport.id}", format: :json,
access_token: access_token.token,
airport: { name: 'New Airport', country: 'New Country' }
end
it 'returns 200 status' do
expect(response).to be_success
end
it 'returns list of airports' do
expect(response.body).to have_json_size(1).at_path('airport/')
end
end
describe 'DELETE /destroy' do
let(:access_token) { create(:access_token) }
let(:user) { User.find(access_token.resource_owner_id) }
let(:airport) { create(:airport, :airport_random) }
context 'unauthorized' do
before { delete "/api/v1/airports/#{airport.id}", format: :json, access_token: 1234, airport: attributes_for(:airport, :airport_random) }
it 'returns 401 status if there is invalid access token' do
expect(response.status).to eq 401
end
it 'do not deleted airport' do
expect { response }.to_not change(Airport, :count)
end
end
context 'authorized' do
context 'with valid attributes' do
before { delete "/api/v1/airports/#{airport.id}", format: :json, access_token: access_token.token, airport: airport }
it 'responses with 201' do
expect(response.status).to eq 201
end
it 'delete airport' do
expect { response }.to change(Airport, :count).by(-1)
end
end
end
end
есть Factory
FactoryGirl.define do
factory :access_token, class: Doorkeeper::AccessToken do
application { create(:oauth_application) }
resource_owner_id { create(:user).id }
end
end
FactoryGirl.define do
factory :user do
sequence(:email) { |n| "user#{n}@test.com" }
password '12345678'
password_confirmation '12345678'
role 'visitor'
end
end
user.update!(role: 'admin')
но у мня не получается в принципе сделать запрос от аутентифицированного пользователя