controller specs for PhotoAssociations

app/controllers/photo_associations_controller.rb

@@ -3,11 +3,11 @@ class PhotoAssociationsController < ApplicationController
   respond_to :json, :html
 
   def destroy
-    @photo = Photo.find(params[:photo_id])
+    @photo = Photo.find_by!(id: params[:photo_id], owner: current_member)
     collection = Growstuff::Constants::PhotoModels.get_relation(@photo, params[:type])
     item_class = Growstuff::Constants::PhotoModels.get_item(params[:type])
     @item = item_class.find_by!(id: params[:id], owner_id: current_member.id)
-    collection.delete(@item) if owner_matches?
+    collection.delete(@item)
     respond_with(@photo)
   end
 

spec/controllers/photo_associations_controller_spec.rb

@@ -0,0 +1,41 @@
+require 'rails_helper'
+
+describe PhotoAssociationsController do
+  login_member
+
+  describe "destroy" do
+    let(:valid_params) do
+      {
+        id: harvest.id,
+        type: 'harvest',
+        photo_id: photo.id
+      }
+    end
+
+    before { photo.harvests << harvest }
+
+    describe "my harvest my photo" do
+      let(:harvest) { FactoryGirl.create :harvest, owner: member }
+      let(:photo) { FactoryGirl.create :photo, owner: member }
+
+      it "removes link" do
+        expect { delete :destroy, valid_params }.to change { photo.harvests.count }.by(-1)
+      end
+    end
+
+    describe "another member's harvest from another member's photo" do
+      let(:harvest) { FactoryGirl.create :harvest }
+      let(:photo) { FactoryGirl.create :photo }
+      it do
+        expect do
+          begin
+            delete :destroy, valid_params
+          rescue
+            nil
+          end
+        end.not_to change { photo.harvests.count }
+      end
+      it { expect { delete :destroy, valid_params }.to raise_error(ActiveRecord::RecordNotFound) }
+    end
+  end
+end