#211: added specs for BuildList controller, updated ability.rb

app/controllers/projects/build_lists_controller.rb

@@ -67,7 +67,7 @@ class Projects::BuildListsController < Projects::BaseController
         @build_list.priority = current_user.build_priority # User builds more priority than mass rebuild with zero priority
 
         flash_options = {:project_version => @build_list.project_version, :arch => arch.name, :build_for_platform => build_for_platform.name}
-        if @build_list.save
+        if authorize!(:create, @build_list) && @build_list.save
           notices << t("flash.build_list.saved", flash_options)
         else
           errors << t("flash.build_list.save_error", flash_options)

app/models/ability.rb

@@ -85,7 +85,7 @@ class Ability
         can(:create, BuildList) {|build_list|
           build_list.project.is_package &&
           can?(:write, build_list.project) &&
-          can?(:show, build_list.build_for_platform)
+          (build_list.build_for_platform.blank? || can?(:show, build_list.build_for_platform))
         }
 
         can(:publish, BuildList) do |build_list|

spec/controllers/projects/build_lists_controller_spec.rb

@@ -62,7 +62,7 @@ describe Projects::BuildListsController do
     end
   end
 
-  shared_examples_for 'not create build list' do
+  shared_examples_for 'not create build list' do |skip_new = false|
     before {
       @project.update_attribute(:repositories, @platform.repositories)
     }
@@ -70,7 +70,7 @@ describe Projects::BuildListsController do
     it 'should not be able to perform new action' do
       get :new, :owner_name => @project.owner.uname, :project_name => @project.name
       response.should redirect_to(forbidden_url)
-    end
+    end unless skip_new
 
     it 'should not be able to perform create action' do
       post :create, {:owner_name => @project.owner.uname, :project_name => @project.name}.merge(@create_params)
@@ -259,6 +259,17 @@ describe Projects::BuildListsController do
           it_should_behave_like 'show build list'
           it_should_behave_like 'create build list'
 
+          context 'no ability to read build_for_platform' do
+            before do
+              repository = FactoryGirl.create(:repository)
+              repository.platform.change_visibility
+              Platform.where(:id => @platform.id).update_all(:platform_type => 'personal')
+              @create_params[:build_list].merge!({:include_repos => [repository.id]})
+              @create_params[:build_for_platforms] = [repository.platform_id]
+            end
+            it_should_behave_like 'not create build list', true
+          end
+
         end
 
         context 'if user is project read member' do