Take the 2-minute tour ×

I'm using RSpec and CanCan in a project. I'm testing my permission logic in specs related to the Ability class. For the controllers I really just want to make sure I'm doing an authorization check. I set up a controller macro, but it doesn't seem to be working correctly.

So really I have two questions. One, is the strategy sufficient for testing the permission logic of my controllers (or should I be testing the controller authorization logic more)?

Two, does anyone see what I'm doing wrong to make this not work?

def approve
  plan_order = PlanOrder.find(params[:id])
  authorize! :update, plan_order
  redirect_to plan_order_workout_plan_url(plan_order)

def it_should_check_permissions(*actions)
  actions.each do |action|
    it "#{action} action should authorize user to do this action" do
      @plan_order = Factory(:plan_order, :id=>1)
      ability = Object.new

      get action, :id => 1

The output I get from RSpec is the following

 Failure/Error: ability.should_receive(:can?)
 (#<Object:0x00000006d4fa20>).can?(any args)
     expected: 1 time
     received: 0 times
 # ./spec/controllers/controller_macros/controller_macros.rb:27:in `block (2 levels) in it_should_check_permissions'

I'm not really sure which method I should be checking when I call !authorize in the controller (or it is automatically called via load_and_authorize_resource)

share|improve this question

1 Answer 1

up vote 2 down vote accepted

should_receive is an expectation of something that happens in the future. Reverse these two lines:

get action, :id => 1

so you have this:

get action, :id => 1
share|improve this answer

Your Answer


