I'd expect the two authorization contexts and a stub/spy spec to check that the right query methods were invoked and prevent the database writes at controller spec level. Maybe `stub_chain` and `current_user.events.recent` with a unit test for `Event.recent`?