Template for model/request specs.

activity_request_spec.rb

describe Activity do
  
  let(:admin) { FactoryGirl.create :admin                        }
  let(:user)  { FactoryGirl.create :user, account: admin.account }
  let(:other) { FactoryGirl.create :user       } # Another account
  
  let(:admin_activity) { FactoryGirl.create :activity, user: admin }
  let(:user_activity)  { FactoryGirl.create :activity, user: user  }
  let(:other_activity) { FactoryGirl.create :activity, user: other }
  
  before do
    Account.delete_all
    Warden.test_mode!
  end
  
  after { Warden.test_reset! }
  
  
  describe "GET /activities" do
    
    before { admin_activity; user_activity; other_activity }
    
    context "as a signed in admin" do
      
      before(:each) do
        login_as admin, :scope => :user
        visit activities_path
      end
      
      subject { page }
      it { should be }
      its(:current_path) { should eq activities_path }
      
      it "should have the account-wide activities" do
        page.all('#activities li').count.should eq 2
        page.should have_selector 'li', text: admin.email
      end
      
      it "shouldn't have another account's activities" do
        page.should have_no_selector 'li', text: other.email
      end
    end

    context "as a user" do
      
      before(:each) do
        login_as user, :scope => :user
        visit activities_path
      end
      
      subject { page }
      it { should be }
      its(:current_path) { should eq activities_path }
      
      it "should have the user's activities" do
        page.all('#activities li').count.should eq 1
        page.should have_selector('li', text: user.email)
      end
      
      it "shouldn't have other account info" do
        page.should have_no_selector 'li', text: admin.email
        page.should have_no_selector 'li', text: other.email
      end
    end

    context "as a user from another account" do
      
      before(:each) do
        login_as other, :scope => :user
        visit activities_path
      end
      
      subject { page }
      it { should be }
      its(:current_path) { should eq activities_path }
      
      it "should have it's own activities" do
        page.all('#activities li').count.should eq 1
        page.should have_selector('li', text: other.email)
      end
      
      it "shouldn't have other account's activities" do
        page.should have_no_selector 'li', text: user.email
        page.should have_no_selector 'li', text: admin.email
      end
    end

    context "when not signed in" do
      
      before { logout :user }
      it "should direct you to the sign-in page" do
        visit activities_path
        page.current_path.should eq new_user_session_path
      end
    end
    
    
    describe "GET /activities/users/:id" do

      before { admin_activity; user_activity; other_activity }

      context "as a signed in admin" do

        before(:each) do
          login_as admin, :scope => :user
          visit user_activities_path id: user.id
        end

        subject { page }
        it { should be }
        its(:current_path) { should eq user_activities_path(id: user.id) }

        it "should have the user's activities" do
          page.all('#activities li').count.should eq 1
          page.should have_selector 'li', text: user.email
        end
      end

      context "as a user" do

        before(:each) do
          login_as user, :scope => :user
          visit user_activities_path id: user.id
        end

        subject { page }
        it { should be }
        its(:current_path) { should eq user_activities_path(id: user.id) }

        it "should have the user's activities" do
          page.all('#activities li').count.should eq 1
          page.should have_selector('li', text: user.email)
        end

        it "shouldn't have other user's activities" do
          page.should have_no_selector 'li', text: admin.email
          page.should have_no_selector 'li', text: other.email
        end
      end

      context "as a user from another account" do
        
        before(:each) do
          login_as other, :scope => :user
          visit user_activities_path id: user.id
        end
        
        subject { page }
        it { should be }
        
        its(:current_path) { should_not eq user_activities_path(id: user.id) }
        
        it "shouldn't have other user's activities" do
          page.should have_no_selector 'li', text: user.email
          page.should have_no_selector 'li', text: admin.email
        end
      end

      context "when not signed in" do

        before { logout :user }
        it "should direct you to the sign-in page" do
          visit activities_path
          page.current_path.should eq new_user_session_path
        end
      end
    end
    
    describe "GET /activities/clients/:id" do
      
      let(:user_client)  { FactoryGirl.create :client, user: user  }
      let(:admin_client) { FactoryGirl.create :client, user: admin }
      let(:other_client) { FactoryGirl.create :client, user: other }
      
      before { admin_activity; user_activity; other_activity }
      
      context "as a signed in admin" do
        
        before(:each) do
          login_as admin, :scope => :user
        end
        
        context "viewing his/her own client" do
          
          before { visit client_activities_path(id: admin_client.id) }
          
          subject { page }
          it { should be }
          its(:current_path) { should eq client_activities_path(id: admin_client.id) }

          it "should have the client's activity" do
            page.should have_selector 'li', text: admin_client.display_name
          end
          
          it "shouldn't have other client's activity" do
            page.should have_no_selector 'li', text: user_client.display_name
            page.should have_no_selector 'li', text: other_client.display_name
          end
        end
        
        context "viewing a user's client" do
          
          before { visit client_activities_path(id: user_client.id) }
          
          subject { page }
          it { should be }
          its(:current_path) { should eq client_activities_path(id: user_client.id) }
          
          it "should have the client's activity" do
            page.should have_selector 'li', text: user_client.display_name
          end
          
          it "shouldn't have other client's activity" do
            page.should have_no_selector 'li', text: admin_client.display_name
            page.should have_no_selector 'li', text: other_client.display_name
          end
        end
        
        context "viewing another accounts' client" do
          
          before { visit client_activities_path(id: other_client.id) }
          
          subject { page }
          it { should be }
          its(:current_path) { should_not eq client_activities_path(id: other_client.id) }
          
          it "shouldn't have the activity" do
            page.should have_no_selector 'li', text: other_client.display_name
          end
        end
      end
      
      context "as a user" do
        
        before(:each) do
          login_as user, :scope => :user
        end
        
        context "viewing his/her own client" do
          
          before { visit client_activities_path(id: user_client.id) }
          
          subject { page }
          it { should be }
          its(:current_path) { should eq client_activities_path(id: user_client.id) }
          
          it "should have the client's activity" do
            page.should have_selector 'li', text: user_client.display_name
          end
          
          it "shouldn't have other client's activity" do
            page.should have_no_selector 'li', text: admin_client.display_name
            page.should have_no_selector 'li', text: other_client.display_name
          end
        end
        
        context "viewing another user's client" do
          
          before { visit client_activities_path(id: admin_client.id) }
          
          subject { page }
          it { should be }
          its(:current_path) { should_not eq client_activities_path(id: admin_client.id) }
          
          it "shouldn't have the client's activity" do
            page.should have_no_selector 'li', text: admin_client.display_name
          end
        end
      end
    end
  end
end

user_spec.rb

describe User do

  let(:user) { FactoryGirl.build(:user) }

  subject { user }

  it { should be_valid }
  it { should respond_to(:role)            }
  it { should respond_to(:email)           }
  it { should respond_to(:given_name)      }
  it { should respond_to(:family_name)     }
  it { should respond_to(:account_id)      }
  it { should respond_to(:password_change) }
  it { should respond_to(:archived_items)  }
  it { should respond_to(:external_email)  }
  it { should respond_to(:time_zone)       }

  describe "protected attributes" do
    
    let(:mass_assign) { ActiveModel::MassAssignmentSecurity::Error }
    
    it "shouldn't permit mass assignment" do
      old_role = user.role
      expect { user.update_attributes role: 'admin'       }.to raise_error mass_assign
      expect { user.update_attributes last_request_at: '' }.to raise_error mass_assign
      user.role.should eq old_role
    end
    
    it "should permit individual assignment" do
      user.update_attribute :role, 'admin'
      user.role.should eq 'admin'
    end
  end
  
  describe "devise" do
    
    it "should have an auth token set" do
      user.authentication_token.should_not eq 0
    end
  end
  
  describe "validations" do
    
    it "should require an email address" do
      user.update_attributes email: ''
      user.should_not be_valid
    end
    
    it "shouldn't allow invalid emails" do
      %w[user@foo,com user_at_foo.org example.user@foo.].each do |invalid_email|
        user.update_attributes email: invalid_email
        user.should_not be_valid
      end
    end
    
    context "with duplicate emails" do
      
      let(:user) { FactoryGirl.create :user }
      
      it "shouldn't be permitted" do
        dup_user = FactoryGirl.build :user, email: user.email
        dup_user.should_not be_valid
      end
      
      it "shouldn't be permitted regardless of case" do
        dup_user = FactoryGirl.build :user, email: user.email.upcase
        dup_user.should_not be_valid
      end
      
      it "should consider unconfirmed_email" do
        user.update_attribute :unconfirmed_email, user.email
        dup_user = FactoryGirl.build :user, email: user.email
        dup_user.should_not be_valid
      end
    end
    
    context "with passwords" do
      
      let(:invalid_password) { 'blah' }
      
      it "should require a password" do
        FactoryGirl.build(:user, password: '', password_confirmation: '').should_not be_valid
      end
      
      it "should require the password and it's confirmation to match" do
        FactoryGirl.build(:user, password_confirmation: '').should_not be_valid
      end
      
      it "should reject invalid passwords" do
        FactoryGirl.build(:user, password: invalid_password, password_confirmation: invalid_password).should_not be_valid
      end
    end
    
    describe "password encryption" do
      
      before  { user.save! }
      subject { user       } 
      
      it { should respond_to(:encrypted_password) }
      its(:encrypted_password) { should_not be_blank }
    end
  end
  
  describe "roles" do
    
    let(:user)   { FactoryGirl.build :user      }
    let(:admin)  { FactoryGirl.build :admin     }
    let(:superu) { FactoryGirl.build :superuser }
    
    let(:guest)  { FactoryGirl.build :user, account: FactoryGirl.build(:guest_bucket) }
    
    context "for guest" do
      
      it "shouldn't think a guest is an admin" do
        guest.is_admin?.should be_false
      end
      
      it "shouldn't think a guest is a superuser" do
        guest.is_superuser?.should be_false
      end
      
      it "should think a guest user is in the guest bucket" do
        guest.is_in_guest_bucket?.should be_true
      end
    end
    
    context "for user" do
      
      it "shouldn't think a user is an admin" do
        user.is_admin?.should be_false
      end

      it "shouldn't think a user is a superuser" do
        user.is_superuser?.should be_false
      end
    end
    
    context "for admin" do
      
      it "should think an admin is an admin" do
        admin.is_admin?.should be_true
      end

      it "shouldn't think that an admin is a superuser" do
        admin.is_superuser?.should be_false
      end
    end
    
    context "for superuser" do
      
      it "should think a superuser is an admin" do
        superu.is_admin?.should be_true
      end
      
      it "should think a superuser is a superuser" do
        superu.is_superuser?.should be_true
      end
    end
  end
end