I want users to be able to delete only the tasks that they created (and not the tasks of others). I checked that my application does this through a "rails server". However, the tests come out weird.
Here are the tests in question:
require 'spec_helper'
describe "Authentication" do
subject { page }
describe "signin" do
[...]
describe "authorization" do
[...]
describe "correct user control" do
let(:user) { FactoryGirl.create(:user) }
let(:job) { FactoryGirl.create(:job, user: user) }
let(:wrong_user) { FactoryGirl.create(:user, email: "wrong@example.com") }
let(:wrong_job) { FactoryGirl.create(:job, user: wrong_user) }
before { sign_in user }
[...]
describe "users can only delete their own jobs" do
it "should not change job count" do
expect do
delete job_path(wrong_job)
end.to_not change(Job, :count)
end
end
describe "users can delete their own jobs" do
it "should decrease job count" do
expect do
delete job_path(job)
end.to change(Job, :count).by(-1)
end
end
end
end
end
end
In addition, I get this strange conclusion:
Failures:
1) Authentication signin authorization correct user control users can only delete their own jobs should not decrease job count
Failure/Error: expect do
count should not have changed, but did change from 0 to 1
2) Authentication signin authorization correct user control users can delete their own jobs should decrease job count
Failure/Error: expect do
count should have been changed by -1, but was changed by 1
Why is the number of tasks increasing? Why is the test not working as intended?
Additional Information:
jobs_controller.rb
class JobsController < ApplicationController
skip_before_action :require_signin, only: [:index, :show]
skip_before_action :correct_user, only: [:index, :show, :new, :create]
before_action :set_job, only: [:show, :edit, :update, :destroy]
[...]
def destroy
@job.destroy
respond_to do |format|
format.html { redirect_to jobs_url }
format.json { head :no_content }
end
end
private
def set_job
@job = Job.find(params[:id])
end
def job_params
params.require(:job).permit(:title, :org, :internship, :postdate, :filldate, :location, :link, :description)
end
end
application_controller.rb
class ApplicationController < ActionController::Base
protect_from_forgery with: :exception
before_filter :require_signin
before_filter :correct_user
include SessionsHelper
private
def require_signin
unless signed_in?
store_location
redirect_to signin_url, notice: "Please sign in."
end
end
def correct_user
@job = current_user.jobs.find_by(id: params[:id])
redirect_to root_url if @job.nil?
end
end
rake routes
Prefix Verb URI Pattern Controller
jobs GET /jobs(.:format) jobs
POST /jobs(.:format) jobs
new_job GET /jobs/new(.:format) jobs
edit_job GET /jobs/:id/edit(.:format) jobs
job GET /jobs/:id(.:format) jobs
PATCH /jobs/:id(.:format) jobs
PUT /jobs/:id(.:format) jobs
DELETE /jobs/:id(.:format) jobs
[...]