authentication_matcher.rb

module AuthenticationMatcher
  class RequireAuthentication
    def initialize(method, action, params, context)
      @method  = method
      @action  = action
      @params  = params
      @context = context
    end

    def matches?(controller)
      responds_with_redirect
    end

    def failure_message
      "Expected action :#{@action} with :#{@method} to require authentication"
    end

    def negative_failure_message
      "Did not expect action :#{@action} with :#{@method} to require authentication"
    end

    private

      def responds_with_redirect
        do_request
        @context.response.location == @context.login_url
      end

      def do_request
        @context.__send__(@method, @action, @params)
      end
  end

  def require_authentication_for(method, action, params = {})
    RequireAuthentication.new(method, action, params, self)
  end
end

RSpec.configuration.include AuthenticationMatcher

session_helper.rb

module SessionHelper
  def sign_in(account = nil)
    session[:current_account_id] = account.nil? ? Factory.create(:account).id : account.id
    return account
  end

  def sign_out
    @controller.current_account = nil
  end
end

RSpec.configuration.include SessionHelper, type: :controller

some_controller_spec.rb

# example usage in a controller
describe SomeController, 'authorization' do
  it { should require_authentication_for(:get, :new) }
  it { should require_authentication_for(:post, :create) }

  it { should_not require_authentication_for(:get, :show, :id => "fake_id") }
end