84bd3a69d7
* Add ApiSecret model scaffold * Add relationships between ApiSecret, User, Organization * Add placeholder template to account tab * Add description column to ApiSecrets * Add very basic access token generation * Add basic access token deletion * Show access token on success flash * Add placeholder message when user has no secrets * Use cta style on token generation button * Add presence validation for ApiSecret description * Add ApiSecrets factory * Add pundit policy for ApiSecret * Nest form field within api_secret hash to allow rails strong params * Use pundit to authorize ApiSecretController actions * Add error message flash for ApiSecretsController actions * Add specs for ApiSecretsController * Add length validation to api secret description * Flash model error instead of generic message on save failure * Truncate ApiSecret factory objects descriptions to prevent validation error * Remove length restriction on ApiSecret.description * Use darker font color for token creation date * Consolidate ApiSecret migrations
29 lines
832 B
Ruby
29 lines
832 B
Ruby
require "rails_helper"
|
|
|
|
RSpec.describe ApiSecretPolicy do
|
|
subject { described_class.new(user, api_secret) }
|
|
|
|
let(:api_secret) { build(:api_secret) }
|
|
let(:valid_attributes) { %i[description] }
|
|
|
|
context "when user is not signed in" do
|
|
let(:user) { nil }
|
|
|
|
it { within_block_is_expected.to raise_error(Pundit::NotAuthorizedError) }
|
|
end
|
|
|
|
context "when user owns the secret" do
|
|
let(:user) { api_secret.user }
|
|
|
|
it { is_expected.to permit_actions %i[create destroy] }
|
|
it { is_expected.to permit_mass_assignment_of(valid_attributes) }
|
|
end
|
|
|
|
context "when user does not own the secret" do
|
|
let(:user) { build(:user) }
|
|
|
|
it { is_expected.to permit_actions %i[create] }
|
|
it { is_expected.to forbid_actions %i[destroy] }
|
|
it { is_expected.to permit_mass_assignment_of(valid_attributes) }
|
|
end
|
|
end
|