[openstreetmap/openstreetmap-website] WIP: Move to CanCanCan for authorization (#2023)

[Andy Allan]

gravitystorm commented on this pull request.



> @@ -466,6 +468,23 @@ def better_errors_allow_inline
     raise
   end
 
+  def current_ability
+    Ability.new(current_user).merge(granted_capability)

The tests fail because in our controller tests, the controller state (e.g. instance variables) is not reset between each "request" - see https://github.com/rails/rails/issues/24566 . Calling `get` in a controller test isn't really making an http request, it just calls the methods on the controller object which exists for the length of the test.

So for a simple example, `site_controller_test#test_welcome` calls `get` twice. The memoized result from the first call means that the second logged-in call is also forbidden. This is, ultimately, because you're not really meant to make multiple requests in a single controller testcase - that should be in integration or system tests. But we do this a **lot** in our tests.



-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/openstreetmap/openstreetmap-website/pull/2023#discussion_r225916686
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openstreetmap.org/pipermail/rails-dev/attachments/20181017/ed86f350/attachment-0001.html>