test.rb

begin
  require 'bundler/inline'
rescue LoadError => e
  $stderr.puts 'Bundler version 1.10 or later is required. Please update your Bundler'
  raise e
end

gemfile(true) do
  source 'https://rubygems.org'
  gem 'rails', '5.1.0'  # use correct rails version
  gem 'cancancan' # use correct cancancan version
  gem 'sqlite3' # use another DB if necessary
end

require 'active_record'
require 'action_controller'
require 'cancancan'
require 'cancan/model_adapters/active_record_adapter'
require 'cancan/model_adapters/active_record_4_adapter'
require 'cancan/controller_additions'
require 'minitest/autorun'
require 'logger'

# This connection will do for database-independent bug reports.
ActiveRecord::Base.establish_connection(adapter: 'sqlite3', database: ':memory:')
ActiveRecord::Base.logger = Logger.new(STDOUT)

# create your tables here
ActiveRecord::Schema.define do
  create_table :books, force: true do |t|
    t.integer :library_id
    t.string :name
  end

  create_table :libraries, force: true do |t|
    t.string :name
  end

  create_table :library_users, force: true do |t|
    t.integer :library_id
    t.integer :user_id
    t.boolean :manage
  end

  create_table :users, force: true do |t|
    t.string :name
  end
end

class Book < ActiveRecord::Base
  belongs_to :library
end

class Library < ActiveRecord::Base
  has_many :books
  has_many :library_users
end

class LibraryUser < ActiveRecord::Base
  belongs_to :user
  belongs_to :library
end

class User < ActiveRecord::Base
  has_many :library_users
  has_many :libraries, :through => :library_users
end

class Ability
  include CanCan::Ability

  def initialize(user)
    user.library_users.each do |lu|
      can :read, Library, :id => lu.library_id
      can :read, Book, :library_id => lu.library_id
      can :manage, Book, :library_id => lu.library_id if lu.manage
    end
  end
end

class TestApp < Rails::Application
  config.root = File.dirname(__FILE__)
  config.session_store :cookie_store, key: "cookie_store_key"
  secrets.secret_token    = "secret_token"
  secrets.secret_key_base = "secret_key_base"

  config.logger = Logger.new($stdout)
  Rails.logger  = config.logger

  routes.draw do
    resources :libraries do
      resources :books
    end
  end
end

class BooksController < ActionController::Base
  include CanCan::ControllerAdditions
  load_and_authorize_resource :library
  load_and_authorize_resource :book, :through => :library

  def create
    @book.save!
  end

  def current_user
    User.first
  end

  def current_ability
    Ability.new(current_user)
  end

  def book_params
    params.require(:book).permit(:name)
  end

end

class BooksControllerTest < ActionController::TestCase

  setup do
    @controller = BooksController.new
    @routes = Rails.application.routes
  end

  def test_create
    user = User.create!
    user.library_users.create({
      library: Library.create!(name: 'First'),
      manage: true
    })
    user.library_users.create({
      library: Library.create!(name: 'Second'),
      manage: true
    })
    user.library_users.create({
      library: Library.create!(name: 'Third'),
      manage: false
    })
    second_library = user.libraries.second
    post(:create, params: { library_id: second_library.id, :book => { :name => "Book 1"} })
    assert_equal(Book.first.library, second_library, 'Must be valid parent resource')
  end
end