CONSOLE_OUTPUT

>> a = User.find(2)
=> #<User id: 2, email: "vincent.riviere@company.com", crypted_password: "ef0e221eed190211d5f3c5e74c82da3ac24a5a5a0ac18027a7a...", password_salt: "eetQTWZfnLG7KZmKfaH", persistence_token: "706a2857e2e4c6e80eec3ed0b779fe3c755b4b7446f3d1aa482...", created_at: "2010-09-07 15:23:00", updated_at: "2010-09-07 15:34:22", role: "poweruser", failed_login_count: 0>

# Test validate avec save callback
>> a.agencies
=> [#<Agency id: 19, name: "Nord", division_id: 1, created_at: "2010-09-07 15:22:00", updated_at: "2010-09-07 15:22:00", parent_id: nil>, #<Agency id: 1, name: "Nord-Ouest", division_id: 1, created_at: "2010-09-07 15:21:58", updated_at: "2010-09-07 15:21:58", parent_id: nil>]
>> a.valid?
=> true
>> a.agencies = []
=> []
>> a.valid?
=> false
>> a.save!
ActiveRecord::RecordInvalid: La validation a échoué : Agencies doit être rempli(e)
	from /var/lib/gems/1.8/gems/activerecord-2.3.5/lib/active_record/validations.rb:1090:in `save_without_dirty!'
	from /var/lib/gems/1.8/gems/activerecord-2.3.5/lib/active_record/dirty.rb:87:in `save_without_transactions!'
	from /var/lib/gems/1.8/gems/activerecord-2.3.5/lib/active_record/transactions.rb:200:in `save!'
	from /var/lib/gems/1.8/gems/activerecord-2.3.5/lib/active_record/connection_adapters/abstract/database_statements.rb:136:in `transaction'
	from /var/lib/gems/1.8/gems/activerecord-2.3.5/lib/active_record/transactions.rb:182:in `transaction'
	from /var/lib/gems/1.8/gems/activerecord-2.3.5/lib/active_record/transactions.rb:200:in `save!'
	from /var/lib/gems/1.8/gems/activerecord-2.3.5/lib/active_record/transactions.rb:208:in `rollback_active_record_state!'
	from /var/lib/gems/1.8/gems/activerecord-2.3.5/lib/active_record/transactions.rb:200:in `save!'
	from (irb):22

>> reload!
Reloading...

>> b = User.find(2)
=> #<User id: 2, email: "vincent.riviere@company.com", crypted_password: "ef0e221eed190211d5f3c5e74c82da3ac24a5a5a0ac18027a7a...", password_salt: "eetQTWZfnLG7KZmKfaH", persistence_token: "706a2857e2e4c6e80eec3ed0b779fe3c755b4b7446f3d1aa482...", created_at: "2010-09-07 15:23:00", updated_at: "2010-09-07 15:34:22", role: "poweruser", failed_login_count: 0>
>> b.agencies
=> []
>> b.valid?
=> false

UNIT_TESTS_OUTPUT

mickael@mickael-laptop:~/projects/pabd/test$ ruby unit/user_test.rb 
Loaded suite unit/user_test
Started
.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
Finished in 129.827235 seconds.

769 tests, 769 assertions, 0 failures, 0 errors

user.rb

class User < ActiveRecord::Base
  ## Plugins ##
  acts_as_authentic do |c|
    c.logged_in_timeout = 15.minutes
    c.validates_format_of :email, :with => Authlogic::Regex.bd_format_email
    c.validate_password_field(false)
  end
  
  # Listing roles
  ROLES = Ability.roles

  # Listing values
  AUTHLOGIC_VALUES= I18n.t('responses')

  ## Callbacks ##

  ## Relations ##
  has_and_belongs_to_many :agencies

  ## Validates ##
  validates_presence_of :email, :role
  validates_presence_of :agencies, :if => Proc.new { |user| user.role.eql?('poweruser') }
  validates_inclusion_of :role, :in => ROLES

  ## Scopes ##

  ## Methods ##

  # Define if the user are failed login count
  def authlogic_failed_login_count
    failed_login_count? ? AUTHLOGIC_VALUES[0] : AUTHLOGIC_VALUES[1]
  end

  # Define if the failed_login_count is yes or no
  def authlogic_failed_login_count=(value)
    value.eql?(AUTHLOGIC_VALUES[0]) ? self.failed_login_count = UserSession.consecutive_failed_logins_limit : self.failed_login_count = 0
  end

  # Define if the user have the role parameter
  # param role is the role to check
  def role?(role_sym)
    role.include? role_sym.to_s
  end

  # Define if the user have an admin role
  def admin?
    role? :admin
  end

  # Define if the user is active or not
  def active?
    role?(:admin) || role?(:poweruser)
  end

  # Retrieves user agencies
  def own_agencies
    result = []
    if role?(:admin)
      result = Agency.agencies
    elsif role?(:poweruser)
      result = self.agencies
    end
    
    result
  end

  # Detect if there are multiple agencies to manage
  def manage_many_agencies?
    own_agencies.count > 1
  end

  # Check if agency is manage by the user
  # param agency_id is a number which represent a primary key id (integer)
  def manage_agency?(agency_id)
    result = false
    begin
      a = Agency.find(agency_id)
      result = own_agencies.include?(a)
    rescue Exception => e
      result
    end
  end

  # Define the Distinguished Name for account user on LDAP
  def dn
    "cn=#{self.email},ou=Persons,ou=B&D,dc=businessdecision,dc=com"
  end

  protected

  # Define a password by default
  def apply_default_password
    self.password = "424242"
    self.password_confirmation = "424242"
  end

  # Check if the user is authorized to connect on this App
  def valid_ldap_credentials?(password_plaintext)
    begin
      ldap = LdapConnect.new.ldap
      ldap.auth self.dn, password_plaintext
      ldap.bind # will return false if authentication is NOT successful
    rescue Net::LDAP::LdapError => e
      #TODO Send a mail to inform the administrator
      puts "------------------"
      puts "Message: #{e.message}"
      puts "------------------"
      false
    end
  end

end

user_test.rb

require 'test_helper'

class UserTest < ActiveSupport::TestCase
  subject { Factory(:user, :role => 'admin') }
  
  should_validate_presence_of(:email, :role)
  should_validate_uniqueness_of(:email)

  should_have_and_belong_to_many(:agencies)

  # Testing format mail
  %w(foo@bar.com foo@businessdecision.com@test.com bar@foo.com).each do |mail|
    test "should not save user without a formated businessdecision email #{mail}" do
      user = Factory.build(:user, :email => mail)
      assert !user.save, "Saved the user without a formated bd email"
    end
  end

  # Testing roles
  %w(fake_role 42 unknow test).each do |named_role|
    test "should not save user without accepted role #{named_role}" do
      user = Factory.build(:user, :role => named_role)
      assert !user.save, "Saved the user without accepted role"
    end
  end

  # Testing role 'poweruser'
  test "should not save user with role poweruser without agency to manage" do
    user = Factory.build(:user, :role => 'poweruser', :agencies => [])
    assert !user.save, "Saved the user with role poweruser without agency to manage"
  end
  # Testing role 'poweruser'
  test "should save user with role poweruser and agency to manage" do
    user = Factory.build(:user, :role => 'poweruser', :agencies => [Factory(:agency)])
    assert user.save, "Saved the user with role poweruser and agency to manage"
  end

  ###############################
  # Testing Authorizations      #
  # for user groups :           #
  # Admin / Powerusers / Banned #
  ###############################

  ########################
  # Testing abilities    #
  # Admin authorizations #
  ########################

  # Setting role name
  role_name = 'admin'

  # Testing for public & private resources
  %w(public private).each do |resource_type|
    Ability.admin_resources[resource_type].each do |resource|
      # Create test
      user_can_create_object(role_name, resource)

      # Reading tests
      user_can_read_object_own_by_another_user(role_name, resource)

      # Update tests
      user_can_update_object_own_by_another_user(role_name, resource)

      # Destroy test
      user_can_destroy_object_own_by_another_user(role_name, resource)

      # Index test
      user_can_index_object(role_name, resource)
    end
  end

  #############################
  # Testing abilities         #
  # Powerusers authorizations #
  #############################

  # Setting role name
  role_name = 'poweruser'

  # Testing for Public resources
  Ability.public_resources.each do |resource|
    # Create test
    user_can_create_object(role_name, resource)

    # Reading tests
    user_can_read_object(role_name, resource)
    user_cannot_read_object_own_by_another_user(role_name, resource)

    # Update tests
    user_can_update_his_own_object(role_name, resource)
    user_cannot_update_object_own_by_another_user(role_name, resource)

    # Destroy tests
    user_can_destroy_his_own_object(role_name, resource)
    user_cannot_destroy_object_own_by_another_user(role_name, resource)

    # Index tests
    user_can_index_object(role_name, resource)
  end

  # Testing for Private resources
  Ability.private_resources.each do |resource|
    # Create test
    user_cannot_create_object(role_name, resource)

    # Reading test
    user_cannot_read_object(role_name, resource)

    # Update test
    user_cannot_update_object(role_name, resource)

    # Destroy test
    user_cannot_destroy_object(role_name, resource)

    # Index test
    user_cannot_index_object(role_name, resource)
  end

  #########################
  # Testing abilities     #
  # Banned authorizations #
  #########################

  # Setting role name
  role_name = 'banned'

  # Testing for public & private resources
  %w(public private).each do |resource_type|
    Ability.admin_resources[resource_type].each do |resource|
      # Create test
      user_cannot_create_object(role_name, resource)

      # Reading test
      user_cannot_read_object(role_name, resource)

      # Update test
      user_cannot_update_object(role_name, resource)

      # Destroy test
      user_cannot_destroy_object(role_name, resource)

      # Index test
      user_cannot_index_object(role_name, resource)
    end
  end
end

I'm currently using Rails 2.3.5 which contain an issue about update_attribute methods. Like this url said : http://tinyurl.com/37os8go

HABTM relations in Rails 2.3.5 will be save BEFORE and validate AFTER. That's why, agencies validate will raise an exception but update with the empty array.