diff --git a/app/controllers/comments_controller.rb b/app/controllers/comments_controller.rb index db6b1dd..5233213 100644 --- a/app/controllers/comments_controller.rb +++ b/app/controllers/comments_controller.rb @@ -20,7 +20,12 @@ class CommentsController < ApplicationController #TODO Add Authorization def destroy - respond_with Comment.destroy(params[:id]) + comment = Comment.find(params[:id]) + if comment.user == current_user + respond_with comment.delete + else + raise Unauthorized + end end private diff --git a/spec/controllers/comments_controller_spec.rb b/spec/controllers/comments_controller_spec.rb index 1d6bdab..6cc72ae 100644 --- a/spec/controllers/comments_controller_spec.rb +++ b/spec/controllers/comments_controller_spec.rb @@ -2,19 +2,17 @@ require 'spec_helper' describe CommentsController do - let(:user) { mock_model(User) } + let(:user) { Factory(:user) } let(:asciicast) { mock_model(Asciicast) } - it "should ensure user is authenticated" do - - end - before do - Asciicast.stub(:find).and_return(asciicast) login_as(user) end describe "#create" do + before do + Asciicast.stub(:find).and_return(asciicast) + end context "given valid data" do def dispatch @@ -60,6 +58,9 @@ describe CommentsController do end describe "#index" do + before do + Asciicast.stub(:find).and_return(asciicast) + end it "return comments" do asciicast.should_receive(:comments).and_return([]) @@ -68,4 +69,37 @@ describe CommentsController do end + describe "#destroy" do + let(:comment) { mock_model(Comment).as_null_object } + before do + Comment.stub(:find).with("1").and_return(comment) + end + + context "when user is creator of comment" do + before do + comment.stub(:user).and_return(user) + end + + it "calls delete on comment" do + comment.should_receive(:delete) + delete :destroy, :id => 1 + end + + end + + context "when user is not creator of comment" do + let(:other_user) { Factory(:user) } + + before do + comment.stub(:user).and_return(other_user) + end + + it "raise Unauthorized exception" do + expect { + delete :destroy, :id => 1 + }.to raise_error + end + + end + end end