application_controller.rb

class ApplicationController < ActionController::Base
  # Prevent CSRF attacks by raising an exception.
  # For APIs, you may want to use :null_session instead.
  protect_from_forgery with: :exception
  
  private

  def current_user
    @current_user ||= User.find(session[:user_id]) if session[:user_id]
    rescue ActiveRecord::RecordNotFound
      session.delete(:user_id)
    nil
  end
  helper_method :current_user

  def is_staff?
    current_user && current_user.is_staff?
  end
  helper_method :is_staff?
  
  def authorize
    !current_user.nil? || redirect_to(session_url)
  end
end

error.log

Run options: include {:locations=>{"./spec/controllers/topics_controller_spec.rb"=>[25]}}

TopicsController
  without permission to lock a topic
    should redirect to forum_path (FAILED - 1)

Failures:

  1) TopicsController without permission to lock a topic should redirect to forum_path
     Failure/Error: response.should redirect_to(forum_topic_path(forum, topic))
       Expected response to be a redirect to <http://test.host/forums/dynamic-markets-developer/topics/dynamic-paradigm-assistant> but was a redirect to <http://test.host/login>.
       Expected "http://test.host/forums/dynamic-markets-developer/topics/dynamic-paradigm-assistant" to be === "http://test.host/login".
     # ./spec/controllers/topics_controller_spec.rb:27:in `block (3 levels) in <top (required)>'

Finished in 1.2 seconds
1 example, 1 failure

Failed examples:

rspec ./spec/controllers/topics_controller_spec.rb:24 # TopicsController without permission to lock a topic should redirect to forum_path

topics_controller.rb

class TopicsController < ApplicationController
  before_filter :find_forum
  before_filter :authorize, only: [:new, :edit, :update, :lock, :unlock]
  before_action :set_topic, only: [:show, :edit, :update]

  def index 
    redirect_to forum_path(@forum)
  end

  def show
    @topic = Topic.friendly.find(params[:id])
    @posts = @topic.posts.order('created_at ASC')
    @post = Post.new
  end

  def lock
    @topic = Topic.friendly.find(params[:topic_id])
    respond_to do |format|
      if @topic.is_owner_or_staff?(current_user)
        @topic.update_attribute(:is_locked, true)
        format.html { redirect_to forum_topic_path(@forum, @topic), notice: 'Topic is now locked!' }
      else
        format.html { redirect_to forum_topic_path(@forum, @topic) }
      end
    end
  end

  def unlock
    @topic = Topic.friendly.find(params[:topic_id])
    respond_to do |format|
      if @topic.is_owner_or_staff?(current_user)
        @topic.update_attribute(:is_locked, false)
        format.html { redirect_to forum_topic_path(@forum, @topic), notice: 'Topic is now unlocked!' }
      else
        format.html { redirect_to forum_topic_path(@forum, @topic) }
      end
    end
  end
  
  private
    def find_forum
      @forum = Forum.friendly.find(params[:forum_id])
    end

    def set_topic
      @topic = Topic.friendly.find(params[:id])
    end

    # Allow only the white list
    def topic_params
      params.require(:topic).permit(:name, user_id: current_user.id , posts_attributes: [ :id, :bodytext ])
    end
end

topics_controller_spec.rb

require 'spec_helper'

describe TopicsController do

  context 'GET index' do
    let(:forum) { create(:forum) }
    let(:topic) { create(:topic) }
    it 'should redirect to forum_path' do
      get :index, { forum_id: forum }

      response.should redirect_to(forum_path(forum))
    end
  end

  context 'without permission to lock a topic' do
    let(:forum) { create(:forum) }
    let(:topic) { create(:topic) }
    let(:user) { create(:user) }

    before do
      session[:user_id] = user.id
    end

    it 'should redirect to forum_path' do
      put :lock, { forum_id: forum, topic_id: topic }

      response.should redirect_to(forum_topic_path(forum, topic))

      page.html.should_not match('Topic is now locked!')
    end
  end
end

users_helper.rb

module UserHelper

  def login_user(user)
    visit session_path
    fill_in 'Email', with: user.email
    fill_in 'Password', with: user.password
    click_button 'Login'
  end

  def logout_user
    visit root_path
    click_link 'Logout'
  end

end