Requires user to be signed in when changing notification settings

app/controllers/groups/notification_settings_controller.rb

@@ -1,4 +1,6 @@
 class Groups::NotificationSettingsController < Groups::ApplicationController
+  before_action :authenticate_user!
+
   def update
     notification_setting = current_user.notification_settings_for(group)
     saved = notification_setting.update_attributes(notification_setting_params)

app/controllers/projects/notification_settings_controller.rb

@@ -1,4 +1,6 @@
 class Projects::NotificationSettingsController < Projects::ApplicationController
+  before_action :authenticate_user!
+
   def create
     notification_setting = current_user.notification_settings_for(project)
     saved = notification_setting.update_attributes(notification_setting_params)

spec/controllers/groups/notification_settings_controller_spec.rb

@@ -0,0 +1,17 @@
+require 'spec_helper'
+
+describe Groups::NotificationSettingsController do
+  let(:group) { create(:group) }
+
+  describe '#update' do
+    context 'when not authorized' do
+      it 'redirects to sign in page' do
+        put :update,
+            group_id: group.to_param,
+            notification_setting: { level: NotificationSetting.levels[:participating] }
+
+        expect(response).to redirect_to(new_user_session_path)
+      end
+    end
+  end
+end

spec/controllers/projects/notification_settings_controller_spec.rb

@@ -0,0 +1,31 @@
+require 'spec_helper'
+
+describe Projects::NotificationSettingsController do
+  let(:project) { create(:empty_project) }
+
+  describe '#create' do
+    context 'when not authorized' do
+      it 'redirects to sign in page' do
+        post :create,
+             namespace_id: project.namespace.to_param,
+             project_id: project.to_param,
+             notification_setting: { level: NotificationSetting.levels[:participating] }
+
+        expect(response).to redirect_to(new_user_session_path)
+      end
+    end
+  end
+
+  describe '#update' do
+    context 'when not authorized' do
+      it 'redirects to sign in page' do
+        put :update,
+            namespace_id: project.namespace.to_param,
+            project_id: project.to_param,
+            notification_setting: { level: NotificationSetting.levels[:participating] }
+
+        expect(response).to redirect_to(new_user_session_path)
+      end
+    end
+  end
+end