rails_admin-lbgraham 0.4.2

data/spec/integration/authorization/cancan_spec.rb

@@ -0,0 +1,366 @@
+require 'spec_helper'
+
+class Ability
+  include CanCan::Ability
+  def initialize(user)
+    can :access, :rails_admin if user.roles.include? :admin
+    unless user.roles.include? :test_exception
+      can :dashboard
+      can :manage, Player if user.roles.include? :manage_player
+      can :read, Player, :retired => false if user.roles.include? :read_player
+      can :create, Player, :suspended => true if user.roles.include? :create_player
+      can :update, Player, :retired => false if user.roles.include? :update_player
+      can :destroy, Player, :retired => false if user.roles.include? :destroy_player
+      can :history, Player, :retired => false if user.roles.include? :history_player
+      can :show_in_app, Player, :retired => false if user.roles.include? :show_in_app_player
+    else
+      can :dashboard
+      can :access, :rails_admin
+      can :manage, :all
+      can :show_in_app, :all
+
+
+      # fix for buggy and inconsistent behaviour in Cancan 1.6.8 => https://github.com/ryanb/cancan/issues/721
+      if CI_ORM != :mongoid
+        cannot [:update, :destroy], Player
+        can [:update, :destroy], Player, :retired => false
+      else
+        cannot [:update, :destroy], Player, :retired => true
+      end
+    end
+  end
+end
+
+class AdminAbility
+  include CanCan::Ability
+  def initialize(user)
+    can :access, :rails_admin if user.roles.include? :admin
+    can :show_in_app, :all
+    can :manage, :all
+  end
+end
+
+describe "RailsAdmin CanCan Authorization" do
+
+  subject { page }
+
+  before(:each) do
+    RailsAdmin.config do |c|
+      c.authorize_with(:cancan)
+    end
+    @player_model = RailsAdmin::AbstractModel.new(Player)
+    @user = FactoryGirl.create :user
+    login_as @user
+  end
+
+  describe "with no roles" do
+    before(:each) do
+      @user.update_attributes(:roles => [])
+    end
+
+    it "GET /admin should raise CanCan::AccessDenied" do
+      visit dashboard_path
+      should have_content('CanCan::AccessDenied')
+    end
+
+    it "GET /admin/player should raise CanCan::AccessDenied" do
+      visit index_path(:model_name => "player")
+      should have_content('CanCan::AccessDenied')
+    end
+  end
+
+  describe "with read player role" do
+    before(:each) do
+      @user.update_attributes(:roles => [:admin, :read_player])
+    end
+
+    it "GET /admin should show Player but not League" do
+      visit dashboard_path
+      should have_content("Player")
+      should_not have_content("League")
+      should_not have_content("Add new")
+    end
+
+    it "GET /admin/player should render successfully but not list retired players and not show new, edit, or delete actions" do
+      # ensure :name column to be shown
+      RailsAdmin.config Player do
+        list do
+          field :name
+        end
+      end
+      @players = [
+        FactoryGirl.create(:player, :retired => false),
+        FactoryGirl.create(:player, :retired => true),
+      ]
+
+      visit index_path(:model_name => "player")
+
+      should have_content(@players[0].name)
+      should_not have_content(@players[1].name)
+      should_not have_content("Add new")
+      should have_css('.show_member_link')
+      should_not have_css('.edit_member_link')
+      should_not have_css('.delete_member_link')
+      should_not have_css('.history_show_member_link')
+      should_not have_css('.show_in_app_member_link')
+    end
+
+    it "GET /admin/team should raise CanCan::AccessDenied" do
+      visit index_path(:model_name => "team")
+      should have_content('CanCan::AccessDenied')
+    end
+
+    it "GET /admin/player/new should raise CanCan::AccessDenied" do
+      visit new_path(:model_name => "player")
+      should have_content('CanCan::AccessDenied')
+    end
+
+  end
+
+  describe "with create and read player role" do
+    before(:each) do
+      @user.update_attributes(:roles => [:admin, :read_player, :create_player])
+    end
+
+    it "GET /admin/player/new should render and create record upon submission" do
+      visit new_path(:model_name => "player")
+
+      should_not have_content("Save and edit")
+      should_not have_content("Delete")
+
+      should have_content("Save and add another")
+      fill_in "player[name]", :with   => "Jackie Robinson"
+      fill_in "player[number]", :with => "42"
+      fill_in "player[position]", :with => "Second baseman"
+      click_button "Save" # first(:button, "Save").click
+      should_not have_content("Edit")
+
+      @player = RailsAdmin::AbstractModel.new("Player").first
+      expect(@player.name).to eq("Jackie Robinson")
+      expect(@player.number).to eq(42)
+      expect(@player.position).to eq("Second baseman")
+      expect(@player).to be_suspended # suspended is inherited behavior based on permission
+    end
+
+    it "GET /admin/player/1/edit should raise access denied" do
+      @player = FactoryGirl.create :player
+      visit edit_path(:model_name => "player", :id => @player.id)
+      should have_content('CanCan::AccessDenied')
+    end
+
+  end
+
+  describe "with update and read player role" do
+    before(:each) do
+      @user.update_attributes(:roles => [:admin, :read_player, :update_player])
+    end
+
+    it "GET /admin/player/1/edit should render and update record upon submission" do
+      @player = FactoryGirl.create :player
+      visit edit_path(:model_name => "player", :id => @player.id)
+      should have_content("Save and edit")
+      should_not have_content("Save and add another")
+      should_not have_content("Add new")
+      should_not have_content("Delete")
+      should_not have_content("History")
+      should_not have_content("Show in app")
+      fill_in "player[name]", :with => "Jackie Robinson"
+      click_button "Save" # click_button "Save" # first(:button, "Save").click
+      @player.reload
+      expect(@player.name).to eq("Jackie Robinson")
+    end
+
+    it "GET /admin/player/1/edit with retired player should raise access denied" do
+      @player = FactoryGirl.create :player, :retired => true
+      visit edit_path(:model_name => "player", :id => @player.id)
+      should have_content('CanCan::AccessDenied')
+    end
+
+    it "GET /admin/player/1/delete should raise access denied" do
+      @player = FactoryGirl.create :player
+      visit delete_path(:model_name => "player", :id => @player.id)
+      should have_content('CanCan::AccessDenied')
+    end
+
+  end
+
+  describe "with history role" do
+    it "shows links to history action" do
+
+      @user.update_attributes(:roles => [:admin, :read_player, :history_player])
+      @player = FactoryGirl.create :player
+
+      visit index_path(:model_name => "player")
+        should have_css('.show_member_link')
+        should_not have_css('.edit_member_link')
+        should_not have_css('.delete_member_link')
+        should have_css('.history_show_member_link')
+
+      visit show_path(:model_name => 'player', :id => @player.id)
+        should have_content("Show")
+        should_not have_content("Edit")
+        should_not have_content("Delete")
+        should have_content("History")
+
+    end
+  end
+
+  describe "with show in app role" do
+    it "shows links to show in app action" do
+
+      @user.update_attributes(:roles => [:admin, :read_player, :show_in_app_player])
+      @player = FactoryGirl.create :player
+
+      visit index_path(:model_name => "player")
+        should have_css('.show_member_link')
+        should_not have_css('.edit_member_link')
+        should_not have_css('.delete_member_link')
+        should_not have_css('.history_show_member_link')
+        should have_css('.show_in_app_member_link')
+
+      visit show_path(:model_name => 'player', :id => @player.id)
+        should have_content("Show")
+        should_not have_content("Edit")
+        should_not have_content("Delete")
+        should_not have_content("History")
+        should have_content("Show in app")
+
+    end
+  end
+
+  describe "with all roles" do
+    it "shows links to all actions" do
+
+      @user.update_attributes(:roles => [:admin, :manage_player])
+      @player = FactoryGirl.create :player
+
+      visit index_path(:model_name => "player")
+        should have_css('.show_member_link')
+        should have_css('.edit_member_link')
+        should have_css('.delete_member_link')
+        should have_css('.history_show_member_link')
+        should have_css('.show_in_app_member_link')
+
+      visit show_path(:model_name => 'player', :id => @player.id)
+        should have_content("Show")
+        should have_content("Edit")
+        should have_content("Delete")
+        should have_content("History")
+        should have_content("Show in app")
+
+    end
+  end
+
+  describe "with destroy and read player role" do
+    before(:each) do
+      @user.update_attributes(:roles => [:admin, :read_player, :destroy_player])
+    end
+
+    it "GET /admin/player/1/delete should render and destroy record upon submission" do
+      @player = FactoryGirl.create :player
+      player_id = @player.id
+      visit delete_path(:model_name => "player", :id => player_id)
+
+      click_button "Yes, I'm sure"
+
+      expect(@player_model.get(player_id)).to be_nil
+    end
+
+    it "GET /admin/player/1/delete with retired player should raise access denied" do
+      @player = FactoryGirl.create :player, :retired => true
+      visit delete_path(:model_name => "player", :id => @player.id)
+      should have_content('CanCan::AccessDenied')
+    end
+
+    it "GET /admin/player/bulk_delete should render records which are authorized to" do
+      active_player = FactoryGirl.create :player, :retired => false
+      retired_player = FactoryGirl.create :player, :retired => true
+
+      post bulk_action_path(:bulk_action => 'bulk_delete', :model_name => "player", :bulk_ids => [active_player, retired_player].map(&:id))
+
+      expect(response.body).to include(active_player.name)
+      expect(response.body).not_to include(retired_player.name)
+    end
+
+    it "POST /admin/player/bulk_destroy should destroy records which are authorized to" do
+      active_player = FactoryGirl.create :player, :retired => false
+      retired_player = FactoryGirl.create :player, :retired => true
+
+      delete bulk_delete_path(:model_name => "player", :bulk_ids => [active_player, retired_player].map(&:id))
+      expect(@player_model.get(active_player.id)).to be_nil
+      expect(@player_model.get(retired_player.id)).not_to be_nil
+    end
+  end
+
+  describe "with exception role" do
+    it "GET /admin/player/bulk_delete should render records which are authorized to" do
+      @user.update_attributes(:roles => [:admin, :test_exception])
+      active_player = FactoryGirl.create :player, :retired => false
+      retired_player = FactoryGirl.create :player, :retired => true
+
+      post bulk_action_path(:bulk_action => 'bulk_delete', :model_name => "player", :bulk_ids => [active_player, retired_player].map(&:id))
+
+      expect(response.body).to include(active_player.name)
+      expect(response.body).not_to include(retired_player.name)
+    end
+
+    it "POST /admin/player/bulk_destroy should destroy records which are authorized to" do
+      @user.update_attributes(:roles => [:admin, :test_exception])
+      active_player = FactoryGirl.create :player, :retired => false
+      retired_player = FactoryGirl.create :player, :retired => true
+
+      delete bulk_delete_path(:model_name => "player", :bulk_ids => [active_player, retired_player].map(&:id))
+      expect(@player_model.get(active_player.id)).to be_nil
+      expect(@player_model.get(retired_player.id)).not_to be_nil
+    end
+  end
+
+  describe "with a custom admin ability" do
+    before(:each) do
+      RailsAdmin.config{|c| c.authorize_with :cancan, AdminAbility }
+      @user = FactoryGirl.create :user
+      login_as @user
+    end
+
+    describe "with admin role only" do
+      before(:each) do
+        @user.update_attributes(:roles => [:admin])
+      end
+
+      it "GET /admin/team should render successfully" do
+        visit index_path(:model_name => "team")
+        expect(page.status_code).to eq(200)
+      end
+
+      it "GET /admin/player/new should render successfully" do
+        visit new_path(:model_name => "player")
+        expect(page.status_code).to eq(200)
+      end
+
+      it "GET /admin/player/1/edit should render successfully" do
+        @player = FactoryGirl.create :player
+        visit edit_path(:model_name => "player", :id => @player.id)
+        expect(page.status_code).to eq(200)
+      end
+
+      it "GET /admin/player/1/edit with retired player should render successfully" do
+        @player = FactoryGirl.create :player, :retired => true
+        visit edit_path(:model_name => "player", :id => @player.id)
+        expect(page.status_code).to eq(200)
+      end
+
+      it "GET /admin/player/1/delete should render successfully" do
+        @player = FactoryGirl.create :player
+        visit delete_path(:model_name => "player", :id => @player.id)
+        expect(page.status_code).to eq(200)
+      end
+
+      it "GET /admin/player/1/delete with retired player should render successfully" do
+        @player = FactoryGirl.create :player, :retired => true
+        visit delete_path(:model_name => "player", :id => @player.id)
+        expect(page.status_code).to eq(200)
+      end
+    end
+  end
+
+end

data/spec/integration/basic/bulk_action/rails_admin_basic_bulk_action_spec.rb

@@ -0,0 +1,25 @@
+require 'spec_helper'
+
+describe "RailsAdmin Basic Bulk Action" do
+
+  subject { page }
+
+  before(:each) do
+    @players = 2.times.map { FactoryGirl.create :player }
+  end
+
+  describe "bulk_delete" do
+    it "shows names of to-be-deleted players" do
+      post(bulk_action_path(:bulk_action => 'bulk_delete', :model_name => "player", :bulk_ids => @players.map(&:id)))
+      @players.each { |player| expect(response.body).to include(player.name) }
+    end
+  end
+
+  describe "bulk_export" do
+    it "shows form for export" do
+      visit index_path(:model_name => "player")
+      click_link "Export found Players"
+      @players.each { |player| should have_content("Select fields to export") }
+    end
+  end
+end

data/spec/integration/basic/bulk_destroy/rails_admin_basic_bulk_destroy_spec.rb

@@ -0,0 +1,53 @@
+require 'spec_helper'
+
+describe "RailsAdmin Basic Bulk Destroy" do
+  subject { page }
+
+  describe "successful bulk delete of records", :active_record => true do
+    before do
+      RailsAdmin::History.destroy_all
+      RailsAdmin.config { |c| c.audit_with :history }
+      @players = 3.times.map { FactoryGirl.create(:player) }
+      @delete_ids = @players[0..1].map(&:id)
+
+      # NOTE: This uses an internal, unsupported capybara API which could break at any moment. We
+      # should refactor this test so that it either A) uses capybara's supported API (only GET
+      # requests via visit) or B) just uses Rack::Test (and doesn't use capybara for browser
+      # interaction like click_button).
+      page.driver.browser.reset_host!
+      page.driver.browser.process :post, bulk_action_path(:bulk_action => 'bulk_delete', :model_name => "player", :bulk_ids => @delete_ids, '_method' => 'post')
+      click_button "Yes, I'm sure"
+    end
+
+    it "does not contain deleted records" do
+      expect(RailsAdmin::AbstractModel.new("Player").count).to eq(1)
+      expect(RailsAdmin::History.count).to eq(@delete_ids.count)
+      RailsAdmin::History.all.each do |history|
+        expect(history.table).to eq("Player")
+      end
+      RailsAdmin::History.all.each do |history|
+        expect(@delete_ids).to include(history.item)
+      end
+      expect(page).to have_selector(".alert-success", :text => "2 Players successfully deleted")
+    end
+  end
+
+  describe "cancelled bulk_deletion" do
+    before do
+      @players = 3.times.map { FactoryGirl.create(:player) }
+      @delete_ids = @players[0..1].map(&:id)
+
+      # NOTE: This uses an internal, unsupported capybara API which could break at any moment. We
+      # should refactor this test so that it either A) uses capybara's supported API (only GET
+      # requests via visit) or B) just uses Rack::Test (and doesn't use capybara for browser
+      # interaction like click_button).
+      page.driver.browser.reset_host!
+      page.driver.browser.process :post, bulk_action_path(:bulk_action => 'bulk_delete', :model_name => "player", :bulk_ids => @delete_ids, '_method' => 'post')
+      click_button "Cancel"
+    end
+
+    it "does not delete records" do
+      expect(RailsAdmin::AbstractModel.new("Player").count).to eq(3)
+    end
+  end
+end

data/spec/integration/basic/create/rails_admin_basic_create_spec.rb

@@ -0,0 +1,140 @@
+require 'spec_helper'
+
+describe "RailsAdmin Basic Create" do
+  subject { page }
+
+  describe "create" do
+    before(:each) do
+      visit new_path(:model_name => "player")
+      fill_in "player[name]", :with => "Jackie Robinson"
+      fill_in "player[number]", :with => "42"
+      fill_in "player[position]", :with => "Second baseman"
+      click_button "Save" # first(:button, "Save").click
+      @player = RailsAdmin::AbstractModel.new("Player").first
+    end
+
+    it "creates an object with correct attributes" do
+      expect(@player.name).to eq("Jackie Robinson")
+      expect(@player.number).to eq(42)
+      expect(@player.position).to eq("Second baseman")
+    end
+  end
+
+  describe "create and edit" do
+    before(:each) do
+      visit new_path(:model_name => "player")
+
+      fill_in "player[name]", :with => "Jackie Robinson"
+      fill_in "player[number]", :with => "42"
+      fill_in "player[position]", :with => "Second baseman"
+      click_button "Save and edit"
+
+      @player = RailsAdmin::AbstractModel.new("Player").first
+    end
+
+    it "creates an object with correct attributes" do
+      expect(@player.name).to eq("Jackie Robinson")
+      expect(@player.number).to eq(42)
+      expect(@player.position).to eq("Second baseman")
+    end
+  end
+
+  describe "create and add another" do
+    before(:each) do
+      visit new_path(:model_name => "player")
+
+      fill_in "player[name]", :with => "Jackie Robinson"
+      fill_in "player[number]", :with => "42"
+      fill_in "player[position]", :with => "Second baseman"
+      click_button "Save and add another"
+
+      @player = RailsAdmin::AbstractModel.new("Player").first
+    end
+
+    it "creates an object with correct attributes" do
+      expect(@player.name).to eq("Jackie Robinson")
+      expect(@player.number).to eq(42)
+      expect(@player.position).to eq("Second baseman")
+    end
+  end
+
+  describe "create with has-one association" do
+    before(:each) do
+      @draft = FactoryGirl.create :draft
+
+      post new_path(:model_name => "player", :player => {:name => "Jackie Robinson", :number => 42, :position => 'Second baseman', :draft_id => @draft.id})
+
+      @player = RailsAdmin::AbstractModel.new("Player").all.last # first is created by FactoryGirl
+    end
+
+    it "creates an object with correct associations" do
+      @draft.reload
+      expect(@player.draft).to eq(@draft)
+    end
+  end
+
+  describe "create with has-many association" do
+    before(:each) do
+      @divisions = 3.times.map { Division.create!(:name => "div #{Time.now.to_f}", :league => League.create!(:name => "league #{Time.now.to_f}")) }
+      post new_path(:model_name => "league", :league => {:name => "National League", :division_ids =>[@divisions[0].id]})
+      @league = RailsAdmin::AbstractModel.new("League").all.last
+    end
+
+    it "creates an object with correct associations" do
+      @divisions[0].reload
+      expect(@league.divisions).to include(@divisions[0])
+      expect(@league.divisions).not_to include(@divisions[1])
+      expect(@league.divisions).not_to include(@divisions[2])
+    end
+  end
+
+  describe "create with has-and-belongs-to-many association" do
+    before(:each) do
+      @teams = 3.times.map { FactoryGirl.create :team }
+      post new_path(:model_name => "fan", :fan => {:name => "John Doe", :team_ids => [@teams[0].id] })
+      @fan = RailsAdmin::AbstractModel.new("Fan").first
+    end
+
+    it "creates an object with correct associations" do
+      @teams[0].reload
+      expect(@fan.teams).to include(@teams[0])
+      expect(@fan.teams).not_to include(@teams[1])
+      expect(@fan.teams).not_to include(@teams[2])
+    end
+  end
+
+  describe "create with uniqueness constraint violated", :given => "a player exists" do
+    before(:each) do
+      @team = FactoryGirl.create :team
+      @player = FactoryGirl.create :player, :team => @team
+
+      post new_path(:model_name => "player", :player => {:name => @player.name, :number => @player.number.to_s, :position => @player.position, :team_id => @team.id})
+    end
+
+    it "shows an error message" do
+      expect(response.body).to include("There is already a player with that number on this team")
+    end
+  end
+
+  describe "create with invalid object" do
+    before(:each) do
+      post new_path(:model_name => "player", :player => {:id => 1})
+    end
+
+    it "shows an error message" do
+      expect(response.body).to include("Player failed to be created")
+    end
+  end
+
+  describe "create with object with errors on base" do
+    before(:each) do
+      visit new_path(:model_name => "player")
+      fill_in "player[name]", :with => "Jackie Robinson on steroids"
+      click_button "Save and add another"
+    end
+
+    it "shows error base error message in flash" do
+      should have_content("Player failed to be created. Player is cheating")
+    end
+  end
+end