set resource attributes in update action and authorize after set - closes #141

spec/cancan/controller_resource_spec.rb

@@ -8,6 +8,7 @@ describe CanCan::ControllerResource do
     @ability = Ability.new(nil)
     stub(@controller).params { @params }
     stub(@controller).current_ability { @ability }
+    stub(@controller).authorize! { |*args| @ability.authorize!(*args) }
     # stub(@controller_class).cancan_skipper { {:authorize => {}, :load => {}} }
   end
 
@@ -275,6 +276,22 @@ describe CanCan::ControllerResource do
     lambda { resource.process }.should raise_error(CanCan::Unauthorized)
   end
 
+  it "should authorize update action before setting attributes" do
+    @ability.can :update, :projects, :name => "bar"
+    project = Project.create!(:name => "foo")
+    @params.merge!(:action => "update", :id => project.id, :project => {:name => "bar"})
+    resource = CanCan::ControllerResource.new(@controller, :project, :load => true, :authorize => true)
+    lambda { resource.process }.should raise_error(CanCan::Unauthorized)
+  end
+
+  it "should authorize update action after setting attributes" do
+    @ability.can :update, :projects, :name => "foo"
+    project = Project.create!(:name => "foo")
+    @params.merge!(:action => "update", :id => project.id, :project => {:name => "bar"})
+    resource = CanCan::ControllerResource.new(@controller, :project, :load => true, :authorize => true)
+    lambda { resource.process }.should raise_error(CanCan::Unauthorized)
+  end
+
   it "should load the model using a custom class" do
     project = Project.create!
     @params.merge!(:action => "show", :id => project.id)