brandonblack/mongo-tools — pull request #92 by danieljordan10 (2013-05-17 22:42:09+00:00)
Title: Added authentication and authorization features.

This commit includes the new gems 'devise', 'mm-devise', 'cancan', and
'factory_girl_rails.' The first three enable the security features and
the remaining one facilitates testing the user model.

There are many files changed here: security has a way of affecting
everything in an application. Method calls had to be added to just about
every controller action and every single test file had to be changed to
work with authentication.

Writing tests for MongoTools now requires calling at least one
authentication helper. Controller tests and Capybara tests are handled
differently. In controller tests, we can simply use a Devise helper
method to set the session variable directly (this helps performance).
Capybara tests, on the other hand, run in a separate thread and cannot
access the session variables, so there are different helpers that login
manually.

In a controller spec, to login with administrator privileges before each
test, call login_admin_controller just below the first describe or
feature call. (See spec/controllers/monitoring_controller_spec.rb for an
example.) You can do the same thing for a user with default (read-only)
privileges by calling login_regular_user_controller.

In a Capybara-based spec, call login_integ(:type_of_user). User types
can be found in spec/factories/users.rb. Some examples are :test_admin
and :test_default_user, so in an integration test where you just want to
be able to do everything, write

before :each do
login_integ :test_admin
end

at the top of the spec file. There's also a 'logout' method that simply
logs out a user if one is logged in.

See the wiki entry for Authentication and Authorization for more about
settings things up.