Overview

Adding Functional tests to your controllers to test your authentication is easy and powerful with the RoleRequirementTestHelper.

RoleRequirement uses a special "hijacking" approach to test your controllers, to provide the most accurate testing. It removes the target controller action, puts it aside, and puts its own "stub" method in place. Then, it executes the request right through the controller using "get", to checks to see if the action's code was actually called or not. Then, after the test, it puts the original method back in place and everything as was.

This approach to testing provides a more realistic and reliable method of telling whether or not your controller security is working.

Steps

• Install and set up RoleRequirement

• Include both the following in your test_helper.rb file:

require File.expand_path(File.dirname(__FILE__) + "/../config/environment")
require 'test_help'

class Test::Unit::TestCase
...
  include AuthenticatedTestHelper      # You may have already included this
  include RoleRequirementTestHelper
...
end

• Add and create fixtures :users, :roles, and :users_roles (if you are not using a seperate roles table, you can ignore :roles and :users_roles in the rest of these examples). Click here for an example

• Include all user and/or role fixtures to your test controller

class Admin::ListingsControllerTest < Test::Unit::TestCase
  fixtures :users, :roles, :roles_users
...

end

• Start using the assertions
• Here are some examples:

  # :quentin is the label for a fixture in users.yml, with no admin access
  assert_user_can_access(:quentin, "index")
  assert_user_cant_access(:quentin, "destroy", :listing_id => 1)

  # :admin is a user as well, but has the "admin" role.
  assert_user_can_access(:admin, "destroy", :listing_id => 1)

• Here's a more DRY approach

    assert_users_access(
      {:admin => true, :quentin => false},   # admin can access, but quentin can't
      "destroy",                             # test the destroy action
      :listing_id => 1                       # in each test, pass listing_id = 1 to params
    )