can :modify, User, :id => user.id do |user|
  !user.role_changed?  
end  

require 'spec_helper'

describe UsersController do
  include Devise::TestHelpers # to give your spec access to helpers

  before(:each) do
    @user = Factory(:user, :role => 'user', :givenname => 'Old name')
    sign_in @user
  end

  context 'user should not be able to edit another user' do
    
    context 'POST on update' do
      before(:each) do
        @another_user = Factory(:user)
        post :update, :id => @another_user
      end

      it 'should return unathorized access message' do
        flash[:alert].should eq('You are not authorized to access this page.')
      end
    end

  end

  context 'user should be able to change his name' do

    context 'POST on update' do
      before(:each) do
        @user.givenname = "New name"
        post :update, :user => @user.attributes, :id => @user
      end

      it 'should change the given name attribute' do
        assigns[:user].givenname.should eq('New name')
      end
    end
    
  end
  
  context 'user should not be able to change his role field' do
  
    context 'GET on edit' do
      before(:each) do
        get :edit, :id => @user
      end

      it 'should respond with success' do
        response.code.should eq('200')
      end
    end

    context 'POST on update' do
      before(:each) do
        @user.role = 'role changed'
        post :update, :user => @user.attributes, :id => @user
      end
      
      it 'should assign the user after redirect' do
        assigns(:user).should eq(@user)
      end

      it 'should not change the role attribute' do
        assigns[:user].role.should eq('user')
      end

    end
  end

end