Rails: Cucumber forgetting CanCan Authorisations
I'm trying to write up some cucumber tests to ensure cancan permissions are set correctly, and I'm having an odd problem:
When I log in through the following code, capybara says I've logged in as expected. However, when I then go to a resource which requires the given login, I get CanCan's "not authorized" message. Capybara prints out "logged in as testsuperadmin with role superadmin" (the desired role) on the very same "denied access" page.
Accessing the same page manually, not through cucumber/capybara, authorization is granted & everything works fine. Authentication is handled by devise.
I've tried adding @allow-rescue above the scenario and ActionController::Base.allow_rescue = true to features/support/env.rb - neither had any effect.
Any suggestions? This one really has me stumped.
Cheers...
#app/models/ability.rb
class Ability
include CanCan::Ability
def initialize(user)
user ||= User.new
if user.role? :superadmin
can :manage, :all
elsif user.role? :admin
can :manage, [Broker, User]
elsif user.role? :staff
can :manage, Broker
elsif user.role? :broker
can :manage, Broker, :user_id => user.id
can :read, Broker
elsif user.role? :customer
can :manage, User, :id => user.id
else can :read, [Broker]
end
en开发者_如何学编程d
end
# features/brokers.feature
@allow-rescue
Scenario: Successfully create Broker
Given I am logged in as "testsuperadmin" with password "testpassword"
When I go to the create broker page
Then show me the page # Authorization denied here, but signed in successfully if this line moved between "Given I am logged in" ... and "When I go to to create broker page"
......
# features/steps/devise_steps.rb
Given /^I am logged in as "([^\"]*)" with password "([^\"]*)"$/ do |username, password|
#visit path_to(sign in page)
visit "/users/sign_out"
visit "/users/sign_in"
fill_in("user[username]", :with => username)
fill_in("user[password]", :with => password)
click_button("Sign in")
end
# app/controllers/brokers_controller.rb
class BrokersController < ApplicationController
load_and_authorize_resource
# ...
def new
@broker = Broker.new
respond_to do |format|
format.html # new.html.erb
format.xml { render :xml => @broker }
end
end
精彩评论