restrict simple API to A records only

app/controllers/records_controller.rb

@@ -31,14 +31,20 @@ class RecordsController < ApplicationController
   protect_from_forgery :except => 'modify'
   skip_authorize_resource :only => :modify
   
+  MODIFY_ERROR = 'ERROR: only A records can be modified with this API'
+  MODIFY_OK = 'OK'
+  
   # TODO: externalize
   def modify
     @record = Record.where(:authentication_token => params[:authentication_token]).first!
+    if @record.type != 'A'
+      return render :text => MODIFY_ERROR
+    end
     @record.content = params[:ip] || client_remote_ip
     @record.save!
     respond_with(@record) do |format|
       format.html {
-        render :text => 'OK'
+        render :text => MODIFY_OK
       }
     end
   end

spec/controllers/records_controller_spec.rb

@@ -39,6 +39,7 @@ describe RecordsController do
       ip = '127.0.0.2'
       put :modify, :authentication_token => a_record.authentication_token, :ip => ip
       response.should be_success
+      response.body.should == RecordsController::MODIFY_OK
       assigns(:record).should == a_record
       assigns(:record).content.should == ip
     end
@@ -48,10 +49,19 @@ describe RecordsController do
       request.env["HTTP_X_FORWARDED_FOR"] = ip
       put :modify, :authentication_token => a_record.authentication_token
       response.should be_success
+      response.body.should == RecordsController::MODIFY_OK
       assigns(:record).should == a_record
       assigns(:record).content.should == ip
     end
 
+    it "errors when not A type @record with" do
+      ip = '127.0.0.3'
+      request.env["HTTP_X_FORWARDED_FOR"] = ip
+      put :modify, :authentication_token => soa_record.authentication_token
+      response.should be_success
+      response.body.should == RecordsController::MODIFY_ERROR
+    end
+    
   end
   
   describe "GET index" do

spec/support/shared_context/data.rb

@@ -12,4 +12,6 @@ shared_context "data" do
   
   let(:a_record){Factory(:a, :content => '127.0.0.1', :domain => domain)}
   
+  let(:soa_record){domain.soa_record}
+  
 end