Question

Rails beginner here..

I have a users resource where I implemented a callback that’s supposed to prevent an admin user from deleting herself.

before_filter :admin_no_delete,    only: :destroy

def admin_no_delete 
  admin_id = current_user.id if current_user.admin?
  redirect_to root_path if params[:id] == admin_id 
end      

If this looks familiar to some, it’s from Michael Hartl’s rails tutorial, exercise #10 here but I tried to do it differently, not as he suggested.

My (lame) test for this fails

    describe "deleting herself should not be permitted" do
      before do
        delete user_path(admin) 
      end
      it { should_not redirect_to(users_path) }
    end

But exposing a delete link for the admin user just to test and clicking on that link, it seems like the callback actually succeeds in executing (redirecting to root_path).

I was able to invoke the destroy action using jQuery to delete the record being protected by the callback (using Web Inspector’s javascript console):

$.ajax({url: 'http://localhost:3000/users/104', type: 'DELETE', success: function(result){alert(result)} })

Looking for ideas on how to prevent a DELETE HTTP request from succeeding in this situation.. also any ideas on how to properly test for this kind of situation?

Thanks.

Answer 1

Simple: params[:id] is a string, while admin_id is a Fixnum. You can just change it as follows and it should work:

redirect_to root_path if params[:id].to_i == admin_id

The logic you’re using seems a little odd to me, though. Why use a before filter if it’s just for one action, and why change the redirect? I think the logic should be directly in the destroy action and look something like this:

def destroy
  unless current_user.admin? && current_user.id == params[:id].to_i
    User.find(params[:id]).destroy
    flash[:success] = "User destroyed."
  end
  redirect_to users_path
end