Removed update method

Re-structured controller spec
Renamed issuable param to issuable_id

app/assets/javascripts/right_sidebar.js.coffee

@@ -63,7 +63,7 @@ class @Sidebar
       type: ajaxType
       dataType: 'json'
       data:
-        issuable_id: $this.data('issuable')
+        issuable_id: $this.data('issuable-id')
         issuable_type: $this.data('issuable-type')
       beforeSend: =>
         @beforeTodoSend($this, $todoLoading)

app/views/shared/issuable/_sidebar.html.haml

@@ -9,7 +9,7 @@
       %a.gutter-toggle.pull-right.js-sidebar-toggle{ role: "button", href: "#", aria: { label: "Toggle sidebar" } }
         = sidebar_gutter_toggle_icon
       - if current_user
-        %button.btn.btn-default.issuable-header-btn.pull-right.js-issuable-todo{ type: "button", aria: { label: (todo.nil? ? "Add Todo" : "Mark Done") }, data: { todo_text: "Add Todo", mark_text: "Mark Done", issuable: issuable.id, issuable_type: issuable.class.name.underscore, url: namespace_project_todos_path(@project.namespace, @project), delete_path: (dashboard_todo_path(todo) if todo) } }
+        %button.btn.btn-default.issuable-header-btn.pull-right.js-issuable-todo{ type: "button", aria: { label: (todo.nil? ? "Add Todo" : "Mark Done") }, data: { todo_text: "Add Todo", mark_text: "Mark Done", issuable_id: issuable.id, issuable_type: issuable.class.name.underscore, url: namespace_project_todos_path(@project.namespace, @project), delete_path: (dashboard_todo_path(todo) if todo) } }
           %span.js-issuable-todo-text
             - if todo
               Mark Done

config/routes.rb

@@ -797,7 +797,7 @@ Rails.application.routes.draw do
           end
         end
 
-        resources :todos, only: [:create, :update]
+        resources :todos, only: [:create]
 
         resources :uploads, only: [:create] do
           collection do

spec/controllers/projects/todo_controller_spec.rb

@@ -7,101 +7,95 @@ describe Projects::TodosController do
   let(:merge_request) { create(:merge_request, source_project: project) }
 
   context 'Issues' do
-    describe 'POST #create' do
-      before do
-        sign_in(user)
-        project.team << [user, :developer]
+    describe 'POST create' do
+      context 'when authorized' do
+        before do
+          sign_in(user)
+          project.team << [user, :developer]
+        end
+
+        it 'should create todo for issue' do
+          expect do
+            post(:create, namespace_id: project.namespace.path,
+                          project_id: project.path,
+                          issuable_id: issue.id,
+                          issuable_type: 'issue')
+          end.to change { user.todos.count }.by(1)
+
+          expect(response.status).to eq(200)
+        end
       end
 
-      it 'should create todo for issue' do
-        expect do
-          post(:create, namespace_id: project.namespace.path,
-                        project_id: project.path,
-                        issuable_id: issue.id,
-                        issuable_type: "issue")
-        end.to change { user.todos.count }.by(1)
-
-        expect(response.status).to eq(200)
-      end
-    end
-
-    describe 'POST #create when not authorized' do
-      before do
-        sign_in(user)
-      end
-
-      it 'should create todo for issue' do
-        expect do
-          post(:create, namespace_id: project.namespace.path,
-                        project_id: project.path,
-                        issuable_id: issue.id,
-                        issuable_type: "issue")
-        end.to change { user.todos.count }.by(0)
-
-        expect(response.status).to eq(404)
-      end
-    end
-
-    describe 'POST #create when not logged in' do
-      it 'should create todo for issue' do
-        expect do
-          post(:create, namespace_id: project.namespace.path,
-                        project_id: project.path,
-                        issuable_id: issue.id,
-                        issuable_type: "issue")
-        end.to change { user.todos.count }.by(0)
-
-        expect(response.status).to eq(302)
+      context 'when not authorized' do
+        it 'should not create todo for issue that user has no access to' do
+          sign_in(user)
+          expect do
+            post(:create, namespace_id: project.namespace.path,
+                          project_id: project.path,
+                          issuable_id: issue.id,
+                          issuable_type: 'issue')
+          end.to change { user.todos.count }.by(0)
+
+          expect(response.status).to eq(404)
+        end
+
+        it 'should not create todo for issue when user not logged in' do
+          expect do
+            post(:create, namespace_id: project.namespace.path,
+                          project_id: project.path,
+                          issuable_id: issue.id,
+                          issuable_type: 'issue')
+          end.to change { user.todos.count }.by(0)
+
+          expect(response.status).to eq(302)
+        end
       end
     end
   end
 
   context 'Merge Requests' do
-    describe 'POST #create' do
-      before do
-        sign_in(user)
-        project.team << [user, :developer]
+    describe 'POST create' do
+      context 'when authorized' do
+        before do
+          sign_in(user)
+          project.team << [user, :developer]
+        end
+
+        it 'should create todo for merge request' do
+          expect do
+            post(:create, namespace_id: project.namespace.path,
+                          project_id: project.path,
+                          issuable_id: merge_request.id,
+                          issuable_type: 'merge_request')
+          end.to change { user.todos.count }.by(1)
+
+          expect(response.status).to eq(200)
+        end
       end
 
-      it 'should create todo for issue' do
-        expect do
-          post(:create, namespace_id: project.namespace.path,
-                        project_id: project.path,
-                        issuable_id: merge_request.id,
-                        issuable_type: "merge_request")
-        end.to change { user.todos.count }.by(1)
-
-        expect(response.status).to eq(200)
-      end
-    end
-
-    describe 'POST #create when not authorized' do
-      before do
-        sign_in(user)
-      end
-
-      it 'should create todo for issue' do
-        expect do
-          post(:create, namespace_id: project.namespace.path,
-                        project_id: project.path,
-                        issuable_id: merge_request.id,
-                        issuable_type: "merge_request")
-        end.to change { user.todos.count }.by(0)
-
-        expect(response.status).to eq(404)
-      end
-    end
-
-    describe 'POST #create when not logged in' do
-      it 'should create todo for issue' do
-        expect do
-          post(:create, namespace_id: project.namespace.path,
-                        project_id: project.path,
-                        issuable_id: merge_request.id,
-                        issuable_type: "merge_request")
-        end.to change { user.todos.count }.by(0)
-
-        expect(response.status).to eq(302)
+      context 'when not authorized' do
+        it 'should not create todo for merge request user has no access to' do
+          sign_in(user)
+          expect do
+            post(:create, namespace_id: project.namespace.path,
+                          project_id: project.path,
+                          issuable_id: merge_request.id,
+                          issuable_type: 'merge_request')
+          end.to change { user.todos.count }.by(0)
+
+          expect(response.status).to eq(404)
+        end
+
+        it 'should not create todo for merge request user has no access to' do
+          expect do
+            post(:create, namespace_id: project.namespace.path,
+                          project_id: project.path,
+                          issuable_id: merge_request.id,
+                          issuable_type: 'merge_request')
+          end.to change { user.todos.count }.by(0)
+
+          expect(response.status).to eq(302)
+        end
       end
     end
   end