update ability.rb, add new specs

app/controllers/platforms/product_build_lists_controller.rb

@@ -1,11 +1,11 @@
 # -*- encoding : utf-8 -*-
 class Platforms::ProductBuildListsController < Platforms::BaseController
   before_filter :authenticate_user!, :except => [:status_build]
-  skip_before_filter :authenticate_user!, :only => [:index] if APP_CONFIG['anonymous_access']
+  skip_before_filter :authenticate_user!, :only => [:index, :show, :log] if APP_CONFIG['anonymous_access']
   load_and_authorize_resource :platform, :except => [:index, :status_build]
   load_and_authorize_resource :product, :through => :platform, :except => [:index, :status_build]
   load_and_authorize_resource :product_build_list, :through => :product, :except => [:index, :status_build]
-  load_and_authorize_resource :only => [:index]
+  load_and_authorize_resource :only => [:index, :show, :log, :stop]
 
   before_filter :authenticate_product_builder!, :only => [:status_build]
   before_filter :find_product_build_list, :only => [:status_build]
@@ -32,14 +32,10 @@ class Platforms::ProductBuildListsController < Platforms::BaseController
   end
 
   def log
-    respond_to do |format|
-      format.json {
-        render :json => {
-          :log => @product_build_list.log,
-          :building => @product_build_list.build_started?
-        }
-      }
-    end
+    render :json => {
+      :log => @product_build_list.log,
+      :building => @product_build_list.build_started?
+    }
   end
 
   def create

app/models/ability.rb

@@ -20,7 +20,7 @@ class Ability
     can :read, PullRequest, :to_project => {:visibility => 'open'}
     can :search, BuildList
     can [:read, :log, :everything], BuildList, :project => {:visibility => 'open'}
-    can :read, ProductBuildList#, :product => {:platform => {:visibility => 'open'}} # double nested hash don't work
+    can [:read, :log], ProductBuildList#, :product => {:platform => {:visibility => 'open'}} # double nested hash don't work
     can :read, Advisory
 
     # Core callbacks
@@ -114,7 +114,7 @@ class Ability
         can(:read, Product, read_relations_for('products', 'platforms')) {|product| product.platform.main?}
         can([:create, :update, :destroy, :clone], Product) {|product| local_admin? product.platform and product.platform.main?}
 
-        can(:create, ProductBuildList) {|pbl| can?(:update, pbl.product)}
+        can([:create, :stop], ProductBuildList) {|pbl| can?(:update, pbl.product)}
         can(:destroy, ProductBuildList) {|pbl| can?(:destroy, pbl.product)}
 
         can [:read, :create], PrivateUser, :platform => {:owner_type => 'User', :owner_id => user.id}

app/views/platforms/product_build_lists/show.html.haml

@@ -23,9 +23,10 @@
 = render 'show_field', :key => :notified_at, :value => l(pbl.updated_at, :format => :long)
 
 - if pbl.build_started?
-  .leftlist= t("layout.product_build_lists.action")
-  .rightlist= link_to t("layout.product_build_lists.stop"), stop_platform_product_product_build_list_path(pbl.product.platform, pbl.product, pbl)
-  .both
+  - if can? :stop, pbl
+    .leftlist= t("layout.product_build_lists.action")
+    .rightlist= link_to t("layout.product_build_lists.stop"), stop_platform_product_product_build_list_path(pbl.product.platform, pbl.product, pbl)
+    .both
   = render 'shared/log', { :build_started => true, :get_log_path => log_platform_product_product_build_list_path(pbl.product.platform, pbl.product, pbl) }
 
 %h3= t("layout.product_build_lists.results")

spec/controllers/platforms/product_build_lists_controller_spec.rb

@@ -1,16 +1,16 @@
 # -*- encoding : utf-8 -*-
 require 'spec_helper'
 
-shared_examples_for 'admin' do
+shared_examples_for 'product build list admin' do
 
-  it "should be able to create ProductBuildList" do
+  it "should be able to perform create action" do
     expect {
       post :create, valid_attributes
     }.to change(ProductBuildList, :count).by(1)
     response.should redirect_to([@product.platform, @product])
   end
 
-  it "should be able to destroy ProductBuildList" do
+  it "should be able to perform destroy action" do
     @pbl.update_column(:project_id, nil)
     expect {
       delete :destroy, valid_attributes_for_destroy
@@ -18,11 +18,65 @@ shared_examples_for 'admin' do
     response.should redirect_to([@pbl.product.platform, @pbl.product])
   end
 
-  it 'should be able to view ProductBuildLists' do
+  it 'should be able to perform index action' do
     get :index
     response.should render_template(:index)
   end
 
+  it 'should be able to perform stop action' do
+    get :stop, valid_attributes_for_show
+    response.should redirect_to(platform_product_product_build_list_path(@product.platform, @product, @pbl))
+  end
+
+  it 'should be able to perform show action' do
+    get :show, valid_attributes_for_show
+    response.should render_template(:show)
+  end
+
+  it 'should be able to perform log action' do
+    get :log, valid_attributes_for_show
+    response.should be_success
+  end
+
+end
+
+shared_examples_for 'product build list user without admin rights' do
+  it 'should not be able to perform create action' do
+    expect {
+      post :create, valid_attributes
+    }.to change(ProductBuildList, :count).by(0)
+    response.should_not be_success
+  end
+
+  it 'should not be able to perform destroy action' do
+    @pbl.update_column(:project_id, nil)
+    expect {
+      delete :destroy, valid_attributes_for_destroy
+    }.to change(ProductBuildList, :count).by(0)
+    response.should_not be_success
+  end
+
+  it 'should not be able to perform stop action' do
+    get :stop, valid_attributes_for_show
+    response.should_not redirect_to(platform_product_product_build_list_path(@product.platform, @product, @pbl))
+  end
+end
+
+shared_examples_for 'product build list user' do
+  it 'should be able to perform index action' do
+    get :index
+    response.should render_template(:index)
+  end
+
+  it 'should be able to perform show action' do
+    get :show, valid_attributes_for_show
+    response.should render_template(:show)
+  end
+
+  it 'should be able to perform log action' do
+    get :log, valid_attributes_for_show
+    response.should be_success
+  end
 end
 
 describe Platforms::ProductBuildListsController do
@@ -45,27 +99,21 @@ describe Platforms::ProductBuildListsController do
       {:id => @pbl.id, :product_id => @pbl.product.id, :platform_id => @pbl.product.platform.id }
     end
     
-    context 'for guest' do
-      it 'should not be able to create ProductBuildList' do
-        post :create, valid_attributes
-        response.should redirect_to(new_user_session_path)
-      end
+    def valid_attributes_for_show
+      valid_attributes_for_destroy
+    end
 
-      it 'should not be able to destroy ProductBuildList' do
-        @pbl.update_column(:project_id, nil)
-        delete :destroy, valid_attributes_for_destroy
-        response.should redirect_to(new_user_session_path)
-      end
+    context 'for guest' do
+      it_should_behave_like 'product build list user without admin rights'
 
       if APP_CONFIG['anonymous_access']
-        it 'should be able to view ProductBuildLists' do
-          get :index
-          response.should be_success
-        end
+        it_should_behave_like 'product build list user'
       else
-        it 'should not be able to view ProductBuildLists' do
-          get :index
-          response.should redirect_to(new_user_session_path)
+        [:index, :show, :log].each do |action|
+          it "should not be able to perform #{action}" do
+            get action, valid_attributes_for_show
+            response.should redirect_to(new_user_session_path)
+          end
         end
       end
     end
@@ -73,21 +121,8 @@ describe Platforms::ProductBuildListsController do
     context 'for user' do
       before(:each) { set_session_for FactoryGirl.create(:user) }
   
-      it 'should not be able to perform create action' do
-        post :create, valid_attributes
-        response.should redirect_to(forbidden_url)
-      end
-
-      it 'should not be able to perform create action' do
-        @pbl.update_column(:project_id, nil)
-        delete :destroy, valid_attributes_for_destroy
-        response.should redirect_to(forbidden_url)
-      end
-
-      it 'should be able to view ProductBuildLists' do
-        get :index
-        response.should render_template(:index)
-      end 
+      it_should_behave_like 'product build list user'
+      it_should_behave_like 'product build list user without admin rights'
 
     end
 
@@ -98,14 +133,15 @@ describe Platforms::ProductBuildListsController do
         @pbl.product.platform.relations.create!(:actor_type => 'User', :actor_id => @user.id, :role => 'admin')
       end
 
-      it_should_behave_like 'admin'
-
+      it_should_behave_like 'product build list admin'
+      it_should_behave_like 'product build list user'
     end
 
     context 'for global admin' do
       before(:each)  {  set_session_for FactoryGirl.create(:admin) }
 
-      it_should_behave_like 'admin'
+      it_should_behave_like 'product build list admin'
+      it_should_behave_like 'product build list user'
       
     end
   end