Add tests for CMS admin security

spec/requests/admin/cms_spec.rb

@@ -18,4 +18,17 @@ feature %q{
     page.should have_selector 'h1', :text => 'Administration'
   end
 
+  scenario "anonymous user can't access CMS admin" do
+    visit cms_admin_path
+    page.should_not have_content "ComfortableMexicanSofa"
+    page.should have_content "Login"
+  end
+
+  scenario "non-admin user can't access CMS admin" do
+    login_to_consumer_section
+    visit cms_admin_path
+    page.should_not have_content "ComfortableMexicanSofa"
+    page.should have_content "Open Food Web"
+  end
+
 end

spec/support/request/authentication_workflow.rb

@@ -17,6 +17,9 @@ module AuthenticationWorkflow
   end
 
   def login_to_consumer_section
+    # The first user is given the admin role by Spree, so create a dummy user if this is the first
+    create(:user) if Spree::User.admin.empty?
+
     user_role = Spree::Role.create(:name => 'user')
     user = Spree::User.create({
       :email => 'someone@ofw.org',