From c3250c882a692c0a0031a989b96250f100e5e81a Mon Sep 17 00:00:00 2001
From: Eric Davis <edavis@littlestreamsoftware.com>
Date: Mon, 19 Jan 2009 10:40:42 -0800
Subject: [PATCH] Blocked all non-admins from using the RatesController. #1916

---
 app/controllers/rates_controller.rb       |   1 +
 spec/controllers/rates_controller_spec.rb | 117 +++++++++++++++++++++-
 2 files changed, 115 insertions(+), 3 deletions(-)

diff --git a/app/controllers/rates_controller.rb b/app/controllers/rates_controller.rb
index a781cfc..42e5c16 100644
--- a/app/controllers/rates_controller.rb
+++ b/app/controllers/rates_controller.rb
@@ -1,5 +1,6 @@
 class RatesController < ApplicationController
   helper :users
+  before_filter :require_admin
   
   # GET /rates
   # GET /rates.xml
diff --git a/spec/controllers/rates_controller_spec.rb b/spec/controllers/rates_controller_spec.rb
index f046ff8..804c939 100644
--- a/spec/controllers/rates_controller_spec.rb
+++ b/spec/controllers/rates_controller_spec.rb
@@ -1,11 +1,124 @@
 require File.expand_path(File.dirname(__FILE__) + '/../spec_helper')
 
-describe RatesController do
+describe "unauthorized", :shared => true do
+  it 'should not be successful' do
+    do_action
+    response.should_not be_success
+  end
+  
+  it 'should return a 403 status code' do
+    do_action
+    response.code.should eql("403")
+  end
+  
+  it 'should display the standard unauthorized page' do
+    do_action
+    response.should render_template('common/403')
+  end
+  
+  describe "with mime type of xml" do
+  
+    it "should return a 403 error" do
+      request.env["HTTP_ACCEPT"] = "application/xml"
+      do_action
+      response.response_code.should eql(403)
+    end
+  end
 
+end
+
+describe RatesController, "as regular user" do
   def mock_rate(stubs={})
     @mock_rate ||= mock_model(Rate, stubs)
   end
   
+  before(:each) do
+    @user = mock_model(User, :logged? => true, :admin? => false)
+    User.stub!(:current).and_return(@user)
+  end
+  
+  describe "responding to GET index" do
+
+    def do_action
+      get :index
+    end
+    
+    it_should_behave_like "unauthorized"
+
+  end
+
+  describe "responding to GET show" do
+
+    def do_action
+      get :show, :id => "37"
+    end
+    
+    it_should_behave_like "unauthorized"
+
+  end
+
+  describe "responding to GET new" do
+  
+    def do_action
+      get :new
+    end
+    
+    it_should_behave_like "unauthorized"
+
+  end
+
+  describe "responding to GET edit" do
+  
+    def do_action
+      get :edit, :id => "37"
+    end
+    
+    it_should_behave_like "unauthorized"
+    
+  end
+
+  describe "responding to POST create" do
+      
+    def do_action
+      post :create, :rate => {:these => 'params'}
+    end
+    
+    it_should_behave_like "unauthorized"
+
+  end
+
+  describe "responding to PUT udpate" do
+
+    def do_action
+      put :update, :id => "37", :rate => {:these => 'params'}
+    end
+    
+    it_should_behave_like "unauthorized"
+
+  end
+
+  describe "responding to DELETE destroy" do
+
+    def do_action
+      delete :destroy, :id => "37"
+    end
+    
+    it_should_behave_like "unauthorized"
+
+  end
+end
+
+
+describe RatesController, "as an administrator" do
+  def mock_rate(stubs={})
+    @mock_rate ||= mock_model(Rate, stubs)
+  end
+
+  before(:each) do
+    @user = mock_model(User, :logged? => true, :admin? => true)
+    User.stub!(:current).and_return(@user)
+  end
+  
   describe "responding to GET index" do
 
     it "should redirect to the homepage" do
@@ -32,9 +145,7 @@ describe RatesController do
 
   describe "responding to GET index with user" do
     before(:each) do
-      @user = mock_model(User, :logged? => true)
       User.stub!(:find).with(@user.id.to_s).and_return(@user)
-      User.stub!(:current).and_return(@user)
     end
 
     it "should expose all historic rates for the user as @rates" do