# Rails-authorization plugin + rspec meaningful specs?

**URL:** <https://www.ruby-forum.com/t/rails-authorization-plugin-rspec-meaningful-specs/136959>\
**Category:** Rails\
**Created:** [May 7, 2008, 6:13pm UTC](https://www.ruby-forum.com/t/rails-authorization-plugin-rspec-meaningful-specs/136959 "2008-05-07T18:13:38Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![eblatt](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/e/7bcc69/32.png) [@eblatt](https://www.ruby-forum.com/u/eblatt)\
**Post date:** [May 7, 2008, 6:13pm UTC](https://www.ruby-forum.com/t/rails-authorization-plugin-rspec-meaningful-specs/136959/1 "2008-05-07T18:13:38Z")

</div>

Hello,

I’m working with the fabulous authorization\_plugin and have got things  
working pretty well.  
I’m now going back and trying to write some meaningful specs for my  
controller code.

My code has the following line:

class Controller  
[…]  
permit “developer of :app or appowner of :app”  
end

my specs has the following code:

setup do  
@user = mock\_model(User, :user\_id =\> 1)  
@role= mock\_model(Role, :name =\> ‘appowner’)  
@roles = [@role]  
@user.stub!(:roles).and\_return(@roles)  
controller.stub!(:current\_user).and\_return(@user)  
@app = mock\_model(App, :id =\> 1)  
App.should\_receive(:find).with(“1”).and\_return(@app)  
end

I’ve put both of the following lines in my specs, and _both_ of these  
specs pass. According to my understanding, one should pass and one  
should fail.

controller.should\_receive(:permit).with(‘developer of :app or appowner  
of :app’).and\_return(true)  
controller.should\_receive(:permit).with(‘developer of :app or appowner  
of :app’).and\_return(false)

Therefore, my understanding is incomplete. Would anyone be willing to  
share a snippet of their code that illustrates how to write meaningful  
rspecs using the rails-authorization plugin?