Odtnhj

I have an application where users are authors of objects called "Binders". This is a private resource where one user shouldn't be able to view the binder of another user unless it is being shared. I would like my application to 404 whenever a user tries to do such a thing. Here is what I have tried so far.

class BindersController < ApplicationController
 before_action :authenticate_user!
 before_action :set_user, only: [:show, :edit, :update, :destroy]
 before_action :authenticate_access, only: [:show, :edit, :update, :destroy]

 # ...

 private
 def authenticate_access
 if current_user != @binder.user
 respond_to do |format|
 format.html head :missing 
 format.json head :missing 
 end
 end
 end
end

My problem is that Rails prefers to 500 in development and test. This makes this impossible to check with a test like the following.

class BindersControllerTest < ActionDispatch::IntegrationTest
 include Warden::Test::Helpers

 setup do
 @alices_binder = binders(:alices_binder)
 @alice = users(:alice)
 @eve = users(:eve)
 end

 teardown do
 Warden.test_reset!
 end

 test 'binders#show should be missing if accessed by wrong user'
 login_as @eve, scope: :user
 get binder_url(@alices_binder)
 assert_response :missing
 end
end

How can I properly test this behavior out of production?