Notes Used to Craft this Lesson
Next, let's talk about authorization, which differs from authentication. Authentication deals with determining who you are, while authorization deals with determining what you can do.
So, in addition to testing things that require an authenticated user, we also want to test what that authenticated user is allowed to do within our application. For the most part, our PostsController is just a mock; however, at the bottom, there is a real destroy handler mapped to a model and route. This destroy method also performs authorization via Bouncer that ensures only administrators or the post owner can delete the post.
