working on authentication

app/controllers/application_controller.rb

@@ -1,3 +1,3 @@
 class ApplicationController < ActionController::Base
-  protect_from_forgery with: :exception
+  protect_from_forgery with: :exception, prepend: true
 end

app/controllers/schools_controller.rb

@@ -1,11 +1,8 @@
 class SchoolsController < ApplicationController
+  before_action :authenticate_user!, except: [:show]
   before_action :set_school, only: [:admin, :show, :edit, :update, :destroy]
+  before_action :verify_admin, except: [:show, :create, :new]
 
-  # GET /schools
-  # GET /schools.json
-  def index
-    @schools = School.all
-  end
 
   # GET /schools/1
   # GET /schools/1.json
@@ -13,6 +10,9 @@ class SchoolsController < ApplicationController
     @school_categories = @school.school_categories.for_parent_category(@school, nil).sort
   end
 
+  def admin
+  end
+
   # GET /schools/new
   def new
     @school = School.new
@@ -72,4 +72,11 @@ class SchoolsController < ApplicationController
     def school_params
       params.require(:school).permit(:name, :district_id)
     end
+
+    def verify_admin
+      return true if current_user.admin?(@school)
+
+      redirect_to root_path, notice: 'You must be logged in as an admin of that school to access that page.'
+      return false
+    end
 end

app/controllers/users_controller.rb

@@ -0,0 +1,17 @@
+class UsersController < ApplicationController
+
+  def show
+  end
+
+
+  # private
+  #   # Use callbacks to share common setup or constraints between actions.
+  #   def set_district
+  #     @district = District.find(params[:id])
+  #   end
+  #
+  #   # Never trust parameters from the scary internet, only allow the white list through.
+  #   def district_params
+  #     params.require(:district).permit(:name, :state_id)
+  #   end
+end

app/models/user.rb

@@ -3,4 +3,15 @@ class User < ApplicationRecord
   # :confirmable, :lockable, :timeoutable and :omniauthable
   devise :database_authenticatable, :registerable,
          :recoverable, :rememberable, :trackable, :validatable
+
+  has_many :user_schools
+
+  def schools
+    districts = user_schools.map(&:district).compact.uniq
+    (user_schools.map(&:school) + districts.map(&:schools)).flatten.compact.uniq
+  end
+
+  def admin?(school)
+    schools.index(school).present?
+  end
 end

app/models/user_school.rb

@@ -0,0 +1,7 @@
+class UserSchool < ApplicationRecord
+
+  belongs_to :user
+  belongs_to :school
+  belongs_to :district
+
+end

app/views/schools/admin.html.haml

@@ -65,7 +65,7 @@
           %tbody
             %thead{style: 'font-weight: bold;'}
               %th Name
-              %th Descriptin
+              %th Description
               %th{colspan: 2} Actions
             - @school.recipient_lists.each do |recipient_list|
               %tr.recipient

app/views/schools/index.html.haml

@@ -1,17 +0,0 @@
-%h1 Schools
-%table
-  %thead
-    %tr
-      %th Name
-      %th District
-      %th{:colspan => "3"}
-  %tbody
-    - @schools.each do |school|
-      %tr
-        %td= school.name
-        %td= school.district_id
-        %td= link_to 'Show', school
-        %td= link_to 'Edit', edit_school_path(school)
-        %td= link_to 'Destroy', school, method: :delete, data: { confirm: 'Are you sure?' }
-%br/
-= link_to 'New School', new_school_path

app/views/schools/index.json.jbuilder

@@ -1,4 +0,0 @@
-json.array!(@schools) do |school|
-  json.extract! school, :id, :name, :district_id
-  json.url school_url(school, format: :json)
-end

app/views/users/show.html.haml

@@ -0,0 +1,19 @@
+%h2.text-center= current_user.email
+
+%br
+%br
+%br
+%h3 Schools
+- if current_user.schools.blank?
+  %p
+    %strong None Yet
+- else
+  %table{style: 'width: 100%;'}
+    %tbody
+      %thead{style: 'font-weight: bold;'}
+        %th Name
+        %th{colspan: 2}
+        - current_user.schools.each do |school|
+          %tr.school
+            %td= link_to school.name, school
+            %td= link_to('Admin', school_admin_path(school))

config/routes.rb

@@ -21,6 +21,9 @@ Rails.application.routes.draw do
   # resources :attempts, only: [:get, :update]
 
   devise_for :users
+  as :user do
+    get 'users', :to => 'users#show', :as => :user_root # Rails 3
+  end
   # For details on the DSL available within this file, see http://guides.rubyonrails.org/routing.html
 
   get '/admin', to: 'admin#index', as: 'admin'

db/migrate/20170405183356_create_user_schools.rb

@@ -0,0 +1,11 @@
+class CreateUserSchools < ActiveRecord::Migration[5.0]
+  def change
+    create_table :user_schools do |t|
+      t.integer :user_id
+      t.integer :school_id
+      t.integer :district_id
+
+      t.timestamps
+    end
+  end
+end

db/schema.rb

@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema.define(version: 20170317150205) do
+ActiveRecord::Schema.define(version: 20170405183356) do
 
   # These are extensions that must be enabled in order to support this database
   enable_extension "plpgsql"
@@ -152,6 +152,14 @@ ActiveRecord::Schema.define(version: 20170317150205) do
     t.index ["slug"], name: "index_schools_on_slug", unique: true, using: :btree
   end
 
+  create_table "user_schools", force: :cascade do |t|
+    t.integer  "user_id"
+    t.integer  "school_id"
+    t.integer  "district_id"
+    t.datetime "created_at",  null: false
+    t.datetime "updated_at",  null: false
+  end
+
   create_table "users", force: :cascade do |t|
     t.string   "email",                  default: "", null: false
     t.string   "encrypted_password",     default: "", null: false

spec/controllers/schools_controller_spec.rb

@@ -20,6 +20,10 @@ require 'rails_helper'
 
 RSpec.describe SchoolsController, type: :controller do
 
+  let!(:school) { School.create(name: 'school') }
+  let!(:user) { User.create(email: 'test@example.com', password: '123456') }
+  let!(:user_school) { user.user_schools.create(school: school) }
+
   # This should return the minimal set of attributes required to create a valid
   # School. As you add validations to School, be sure to
   # adjust the attributes here as well.
@@ -36,14 +40,6 @@ RSpec.describe SchoolsController, type: :controller do
   # SchoolsController. Be sure to keep this updated too.
   let(:valid_session) { {} }
 
-  describe "GET #index" do
-    it "assigns all schools as @schools" do
-      school = School.create! valid_attributes
-      get :index, params: {}, session: valid_session
-      expect(assigns(:schools)).to eq([school])
-    end
-  end
-
   describe "GET #show" do
     it "assigns the requested school as @school" do
       school = School.create! valid_attributes
@@ -54,104 +50,132 @@ RSpec.describe SchoolsController, type: :controller do
 
   describe "GET #new" do
     it "assigns a new school as @school" do
-      get :new, params: {}, session: valid_session
+      sign_in user
+      get :new, params: {}
       expect(assigns(:school)).to be_a_new(School)
     end
   end
 
   describe "GET #edit" do
     it "assigns the requested school as @school" do
+      sign_in user
       school = School.create! valid_attributes
-      get :edit, params: {id: school.to_param}, session: valid_session
+      get :edit, params: {id: school.to_param}
       expect(assigns(:school)).to eq(school)
     end
   end
 
+  describe "GET #admin" do
+    it "assigns the requested school as @school" do
+      sign_in user
+      get :admin, params: {school_id: school.to_param}
+      expect(assigns(:school)).to eq(school)
+    end
+
+    it "redirects if not logged in" do
+      get :admin, params: {school_id: school.to_param}
+      expect(response).to redirect_to(new_user_session_path)
+    end
+
+    it "redirects if user is not associated with school" do
+      another_user = User.create(email: 'test2@test.com', password: '123456')
+      sign_in another_user
+
+      get :admin, params: {school_id: school.to_param}
+      expect(response).to redirect_to(root_path)
+    end
+  end
+
   describe "POST #create" do
+    before :each do
+      sign_in user
+    end
+
     context "with valid params" do
       it "creates a new School" do
         expect {
-          post :create, params: {school: valid_attributes}, session: valid_session
+          post :create, params: {school: valid_attributes}
         }.to change(School, :count).by(1)
       end
 
       it "assigns a newly created school as @school" do
-        post :create, params: {school: valid_attributes}, session: valid_session
+        post :create, params: {school: valid_attributes}
         expect(assigns(:school)).to be_a(School)
         expect(assigns(:school)).to be_persisted
       end
 
       it "redirects to the created school" do
-        post :create, params: {school: valid_attributes}, session: valid_session
+        post :create, params: {school: valid_attributes}
         expect(response).to redirect_to(School.last)
       end
     end
 
     context "with invalid params" do
       it "assigns a newly created but unsaved school as @school" do
-        post :create, params: {school: invalid_attributes}, session: valid_session
+        post :create, params: {school: invalid_attributes}
         expect(assigns(:school)).to be_a_new(School)
       end
 
       it "re-renders the 'new' template" do
-        post :create, params: {school: invalid_attributes}, session: valid_session
+        post :create, params: {school: invalid_attributes}
         expect(response).to render_template("new")
       end
     end
   end
 
   describe "PUT #update" do
+    before :each do
+      sign_in user
+    end
+
     context "with valid params" do
       let(:new_attributes) {
         {name: 'New School'}
       }
 
       it "updates the requested school" do
-        school = School.create! valid_attributes
+        put :update, params: {id: school.to_param, school: new_attributes}
-        put :update, params: {id: school.to_param, school: new_attributes}, session: valid_session
         school.reload
         expect(school.name).to eq('New School')
       end
 
       it "assigns the requested school as @school" do
-        school = School.create! valid_attributes
+        put :update, params: {id: school.to_param, school: valid_attributes}
-        put :update, params: {id: school.to_param, school: valid_attributes}, session: valid_session
         expect(assigns(:school)).to eq(school)
       end
 
       it "redirects to the school" do
-        school = School.create! valid_attributes
+        put :update, params: {id: school.to_param, school: valid_attributes}
-        put :update, params: {id: school.to_param, school: valid_attributes}, session: valid_session
         expect(response).to redirect_to(school)
       end
     end
 
     context "with invalid params" do
       it "assigns the school as @school" do
-        school = School.create! valid_attributes
+        put :update, params: {id: school.to_param, school: invalid_attributes}
-        put :update, params: {id: school.to_param, school: invalid_attributes}, session: valid_session
         expect(assigns(:school)).to eq(school)
       end
 
       it "re-renders the 'edit' template" do
-        school = School.create! valid_attributes
+        put :update, params: {id: school.to_param, school: invalid_attributes}
-        put :update, params: {id: school.to_param, school: invalid_attributes}, session: valid_session
         expect(response).to render_template("edit")
       end
     end
   end
 
   describe "DELETE #destroy" do
+    before :each do
+      sign_in user
+    end
+
     it "destroys the requested school" do
-      school = School.create! valid_attributes
       expect {
-        delete :destroy, params: {id: school.to_param}, session: valid_session
+        delete :destroy, params: {id: school.to_param}
       }.to change(School, :count).by(-1)
     end
 
     it "redirects to the schools list" do
-      school = School.create! valid_attributes
+      delete :destroy, params: {id: school.to_param}
-      delete :destroy, params: {id: school.to_param}, session: valid_session
       expect(response).to redirect_to(schools_url)
     end
   end

spec/models/user_school_spec.rb

@@ -0,0 +1,5 @@
+require 'rails_helper'
+
+RSpec.describe UserSchool, type: :model do
+  pending "add some examples to (or delete) #{__FILE__}"
+end

spec/spec_helper.rb

@@ -104,6 +104,7 @@ RSpec.configure do |config|
   config.after(:each) do
     FakeSMS.reset
   end
+
 end
 
 

spec/support/devise.rb

@@ -0,0 +1,4 @@
+RSpec.configure do |config|
+  config.include Devise::Test::ControllerHelpers, type: :controller
+  config.include Devise::Test::ControllerHelpers, type: :view
+end

spec/views/schools/index.html.erb_spec.rb

@@ -1,22 +0,0 @@
-require 'rails_helper'
-
-RSpec.describe "schools/index", type: :view do
-  before(:each) do
-    assign(:schools, [
-      School.create!(
-        :name => "Name",
-        :district_id => 2
-      ),
-      School.create!(
-        :name => "Name",
-        :district_id => 2
-      )
-    ])
-  end
-
-  it "renders a list of schools" do
-    render
-    assert_select "tr>td", :text => "Name".to_s, :count => 2
-    assert_select "tr>td", :text => 2.to_s, :count => 2
-  end
-end