Adding tests to commit b5d09afef5

spec/couchrest/more/property_spec.rb

@@ -1,3 +1,4 @@
+# encoding: utf-8
 require File.expand_path('../../../spec_helper', __FILE__)
 require File.join(FIXTURE_PATH, 'more', 'person')
 require File.join(FIXTURE_PATH, 'more', 'card')
@@ -5,6 +6,7 @@ require File.join(FIXTURE_PATH, 'more', 'invoice')
 require File.join(FIXTURE_PATH, 'more', 'service')
 require File.join(FIXTURE_PATH, 'more', 'event')
 require File.join(FIXTURE_PATH, 'more', 'cat')
+require File.join(FIXTURE_PATH, 'more', 'user')
 
 
 describe "ExtendedDocument properties" do
@@ -55,6 +57,30 @@ describe "ExtendedDocument properties" do
     @card.updated_at.should_not be_nil
   end
   
+  
+  describe "mass assignment protection" do
+
+    it "should not store protected attribute using mass assignment" do
+      cat_toy = CatToy.new(:name => "Zorro")
+      cat = Cat.create(:name => "Helena", :toys => [cat_toy], :favorite_toy => cat_toy, :number => 1)
+      cat.number.should be_nil
+      cat.number = 1
+      cat.save
+      cat.number.should == 1
+    end
+
+    it "should not store protected attribute when 'declare accessible poperties, assume all the rest are protected'" do
+      user = User.create(:name => "Marcos Tapajós", :admin => true)
+      user.admin.should be_nil
+    end
+
+    it "should not store protected attribute when 'declare protected properties, assume all the rest are accessible'" do
+      user = SpecialUser.create(:name => "Marcos Tapajós", :admin => true)
+      user.admin.should be_nil
+    end
+
+  end
+  
   describe "validation" do
     before(:each) do
       @invoice = Invoice.new(:client_name => "matt", :employee_name => "Chris", :location => "San Diego, CA")

spec/fixtures/more/cat.rb

@@ -4,9 +4,10 @@ class Cat < CouchRest::ExtendedDocument
   # Set the default database to use
   use_database DB
 
-  property :name
+  property :name, :accessible => true
-  property :toys, :cast_as => ['CatToy'], :default => []
+  property :toys, :cast_as => ['CatToy'], :default => [], :accessible => true
-  property :favorite_toy, :cast_as => 'CatToy'
+  property :favorite_toy, :cast_as => 'CatToy', :accessible => true
+  property :number
 end
 
 class CatToy < Hash

spec/fixtures/more/user.rb

@@ -0,0 +1,22 @@
+class User < CouchRest::ExtendedDocument
+  # Set the default database to use
+  use_database DB
+  property :name, :accessible => true
+  property :admin                     # this will be automatically protected
+end
+
+class SpecialUser < CouchRest::ExtendedDocument
+  # Set the default database to use
+  use_database DB
+  property :name                      # this will not be protected
+  property :admin, :protected => true
+end
+
+# There are two modes of protection
+#  1) Declare accessible poperties, assume all the rest are protected 
+#    property :name, :accessible => true
+#    property :admin                     # this will be automatically protected
+#
+#  2) Declare protected properties, assume all the rest are accessible
+#    property :name                      # this will not be protected
+#    property :admin, :protected => true