Added tasks controller, spec, JS, apitesthelper

Had an issue with calling render_views in the specs to render the
jbuilder json templates and also getting the devise sign_in method to
work, ended up adding a helper to add the username/password for a user

app/assets/javascripts/task_lists.js

@@ -0,0 +1,32 @@
+$(".task_list_task").click(function(){
+  $("#update_tasks_submit").removeClass("disabled");
+});
+
+$("#update_tasks_submit").click(function(){
+
+  tasks = [];
+  $(".task_list_task").each(function(){
+    tasks.push({
+      id: parseInt($(this).data("id")),
+      done: $(this).is(":checked")
+    });
+  });
+
+  json_data = { tasks: tasks };
+
+  $.ajax({
+    url: $("#update_tasks_submit").data("url"),
+    type: "PUT",
+    data: JSON.stringify(json_data),
+    contentType: 'application/json',
+    dataType: "json",
+    success: function(data, status, xhr){
+      //should re-render via JS, but for now reload
+      location.reload();
+    },
+    error: function(data, status ){
+      alert("An error occured updating tasks");
+      //displayFormErrors(data.responseJSON);
+    }
+  });
+});

app/controllers/api/v1/tasks_controller.rb

@@ -0,0 +1,64 @@
+class Api::V1::TasksController < Api::V1::BaseController
+  EXPECTED_TASKS = "Expected a list of tasks in submitted data."
+  CANNOT_MANAGE = "You do not have permission to manage this task."
+  NOT_FOUND = "The task could not be found."
+
+  before_filter :validate_params
+  before_filter :get_tasks
+  before_filter :check_task_permission, except: :show
+
+  def update
+    errors = []
+    @tasks.each do |task_hash|
+      task = task_hash[:record]
+      attrs = task_hash[:new_attributes]
+      task.update_attributes(attrs)
+      if !task.errors.empty?
+        errors << { id: task.id, errors: task.errors }
+      end
+    end
+
+    if !errors.empty?
+      render json: { errors: errors }, status: 422 and return
+    end
+  end
+
+  private
+    def validate_params
+      if params[:tasks].nil? and not params[:tasks].kind_of?(Array)
+        render json: { errors: [EXPECTED_TASKS]}, status: 422 and return
+      end
+    end
+
+    def get_tasks
+      @tasks = []
+      errors = []
+
+      params[:tasks].each do |task|
+        t = Task.find_by_id(task[:id])
+        if t.nil?
+          errors << { id: task[:id], error: NOT_FOUND }
+        else
+          @tasks << { record: t, new_attributes: task }
+        end
+      end
+
+      if !errors.empty?
+          render json: { errors: errors }, status: 404 and return
+      end
+    end
+
+    def check_task_permission
+      errors = []
+      @tasks.each do |task_hash|
+        task = task_hash[:record]
+        if task.task_list.item != current_user.bike
+          errors << { id: task[:id], error: CANNOT_MANAGE }
+        end
+      end
+
+      if cannot? :manage, Bike and !errors.empty?
+        render json: { errors: errors}, status: 403 and return
+      end
+    end
+end

app/views/api/v1/tasks/update.json.jbuilder

@@ -0,0 +1,3 @@
+json.tasks [@tasks.map{|x| x[:record]}] do |task|
+  json.array! task
+end