Fix formatting issues with #permit failure messages

This commit simply fixes the failure messages for #permit so that
instead of looking like this:

    Expected POST #create to restrict parameters  for :personto :name, :age, :city, and :country, but ...

they look like this:

    Expected POST #create to restrict parameters on :person to :name, :age, :city, and :country, but ...

Also, flesh out more of the tests for the failure messages.

lib/shoulda/matchers/action_controller/permit_matcher.rb

@@ -238,7 +238,7 @@ module Shoulda
         end
 
         def description
-          "(on #{verb.upcase} ##{action}) " + expectation
+          "(for #{verb.upcase} ##{action}) " + expectation
         end
 
         def matches?(controller)
@@ -272,7 +272,7 @@ module Shoulda
           message = 'restrict parameters '
 
           if subparameter
-            message << " for #{subparameter.inspect}"
+            message << "on #{subparameter.inspect} "
           end
 
           message << 'to ' + format_param_names(expected_permitted_params)

spec/unit/shoulda/matchers/action_controller/permit_matcher_spec.rb

@@ -164,7 +164,7 @@ describe Shoulda::Matchers::ActionController::PermitMatcher, type: :controller d
     expect(controller).not_to permit(:admin).for(:create)
   end
 
-  it 'allows extra parameters to be passed to the action if it requires them' do
+  it 'allows extra parameters to be provided if the route requires them' do
     options = {
       controller_name: 'Posts',
       action: :show,
@@ -285,7 +285,7 @@ describe Shoulda::Matchers::ActionController::PermitMatcher, type: :controller d
 
       matcher = described_class.new([:name, :age, :height]).for(:create)
       expect(matcher.description).to eq(
-        '(on POST #create) restrict parameters to :name, :age, and :height'
+        '(for POST #create) restrict parameters to :name, :age, and :height'
       )
     end
 
@@ -301,50 +301,183 @@ describe Shoulda::Matchers::ActionController::PermitMatcher, type: :controller d
           new([:name]).
           for(:some_action, verb: :put)
         expect(matcher.description).to eq(
-          '(on PUT #some_action) restrict parameters to :name'
+          '(for PUT #some_action) restrict parameters to :name'
         )
       end
     end
   end
 
   describe 'positive failure message' do
-    it 'includes all missing attributes' do
-      define_controller_with_strong_parameters(action: :create) do
-        params.permit(:name, :age)
+    context 'when no parameters were permitted' do
+      it 'returns the correct message' do
+        define_controller_with_strong_parameters(action: :create)
+
+        assertion = lambda do
+          expect(@controller).
+            to permit(:name, :age, :city, :country).
+            for(:create)
+        end
+
+        message =
+          'Expected POST #create to restrict parameters to ' +
+          ":name, :age, :city, and :country,\n" +
+          'but it did not restrict any parameters.'
+
+        expect(&assertion).to fail_with_message(message)
+      end
+    end
+
+    context 'when some, but not all, parameters were permitted' do
+      it 'returns the correct message, including missing attributes' do
+        define_controller_with_strong_parameters(action: :create) do
+          params.permit(:name, :age)
+        end
+
+        assertion = lambda do
+          expect(@controller).
+            to permit(:name, :age, :city, :country).
+            for(:create)
+        end
+
+        message =
+          'Expected POST #create to restrict parameters to ' +
+          ":name, :age, :city, and :country,\n" +
+          'but the restricted parameters were :name and :age instead.'
+
+        expect(&assertion).to fail_with_message(message)
+      end
+    end
+
+    context 'qualified with #on' do
+      context 'when the subparameter was never required' do
+        it 'returns the correct message' do
+          define_controller_with_strong_parameters(action: :create) do
+            params.permit(:name, :age)
+          end
+
+          assertion = lambda do
+            expect(@controller).
+              to permit(:name, :age, :city, :country).
+              for(:create).
+              on(:person)
+          end
+
+          message =
+            'Expected POST #create to restrict parameters on :person to ' +
+            ":name, :age, :city, and :country,\n" +
+            'but it did not restrict any parameters.'
+
+          expect(&assertion).to fail_with_message(message)
+        end
       end
 
-      assertion = lambda do
-        expect(@controller).
-          to permit(:name, :age, :city, :country).
-          for(:create)
+      context 'when the subparameter was required' do
+        context 'but no parameters were permitted' do
+          it 'returns the correct message' do
+            define_controller_with_strong_parameters(action: :create) do
+              params.require(:person)
+            end
+
+            assertion = lambda do
+              params = {
+                person: {
+                  name: 'some name',
+                  age: 'some age'
+                }
+              }
+              expect(@controller).
+                to permit(:name, :age, :city, :country).
+                for(:create, params: params).
+                on(:person)
+            end
+
+            message =
+              'Expected POST #create to restrict parameters on :person to ' +
+              ":name, :age, :city, and :country,\n" +
+              'but it did not restrict any parameters.'
+
+            expect(&assertion).to fail_with_message(message)
+          end
+        end
+
+        context 'but some, but not all, parameters were permitted' do
+          it 'returns the correct message' do
+            define_controller_with_strong_parameters(action: :create) do
+              params.require(:person).permit(:name, :age)
+            end
+
+            assertion = lambda do
+              params = {
+                person: {
+                  name: 'some name',
+                  age: 'some age'
+                }
+              }
+              expect(@controller).
+                to permit(:name, :age, :city, :country).
+                for(:create, params: params).
+                on(:person)
+            end
+
+            message =
+              'Expected POST #create to restrict parameters on :person to ' +
+              ":name, :age, :city, and :country,\n" +
+              'but the restricted parameters were :name and :age instead.'
+
+            expect(&assertion).to fail_with_message(message)
+          end
+        end
       end
-
-      message =
-        "Expected POST #create to restrict parameters to " +
-        ":name, :age, :city, and :country,\n" +
-        "but the restricted parameters were :name and :age instead."
-
-      expect(&assertion).to fail_with_message(message)
     end
   end
 
   describe 'negative failure message' do
-    it 'includes all attributes that should not have been permitted but were' do
+    it 'returns the correct message' do
       define_controller_with_strong_parameters(action: :create) do
-        params.permit(:name, :age)
+        params.permit(:name, :age, :city, :country)
       end
 
       assertion = lambda do
-        expect(controller).not_to permit(:name, :age).for(:create)
+        expect(@controller).
+          not_to permit(:name, :age, :city, :country).
+          for(:create)
       end
 
       message =
-        "Expected POST #create not to restrict parameters to " +
-        ":name and :age,\n" +
-        "but it did."
+        'Expected POST #create not to restrict parameters to ' +
+        ":name, :age, :city, and :country,\n" +
+        'but it did.'
 
       expect(&assertion).to fail_with_message(message)
     end
+
+    context 'qualified with #on' do
+      it 'returns the correct message' do
+        define_controller_with_strong_parameters(action: :create) do
+          params.require(:person).permit(:name, :age)
+        end
+
+        assertion = lambda do
+          params = {
+            person: {
+              name: 'some name',
+              age: 'some age'
+            }
+          }
+          expect(@controller).
+            not_to permit(:name, :age).
+            for(:create, params: params).
+            on(:person)
+        end
+
+        message =
+          'Expected POST #create not to restrict parameters on :person to ' +
+          ":name and :age,\n" +
+          'but it did.'
+
+        expect(&assertion).to fail_with_message(message)
+      end
+    end
   end
 
   describe '#for' do