Let Redaktion grant and revoke its own role

Any holder may add or remove another account, witnessed as
redaktion_grant/revoke so the vouching is legible. Not behind elevation:
onboarding must not wait for a keyholder, and a compromised Redaktion
account can already publish.

2 files changed, 18 insertions, 0 deletions

diff --git a/app/views/users/_user.html.erb b/app/views/users/_user.html.erb
index ff9d4e37..ba82375d 100644
--- a/app/views/users/_user.html.erb
+++ b/app/views/users/_user.html.erb
@@ -26,5 +26,22 @@
       <% end %>
     <% end %>
   </td>
+  <td>
+    <% if current_user.redaktion? && !user.alumni? %>
+      <% if user.redaktion? %>
+        <% unless user == current_user %>
+          <%= button_to t(".revoke_redaktion"), revoke_redaktion_user_path(user), method: :put,
+                form: { data: { confirm: t(".confirm_revoke_redaktion", :login => user.login) },
+                        class: 'button_to destructive' } %>
+        <% end %>
+      <% elsif user.otp_enrolled? %>
+        <%= button_to t(".grant_redaktion"), grant_redaktion_user_path(user), method: :put,
+              form: { data: { confirm: t(".confirm_grant_redaktion", :login => user.login) },
+                      class: 'button_to state_changing' } %>
+      <% else %>
+        <span class="field_hint"><%= t(".needs_otp") %></span>
+      <% end %>
+    <% end %>
+  </td>
 </tr>
 <% end %>
diff --git a/app/views/users/index.html.erb b/app/views/users/index.html.erb
index 854811a2..2936bbea 100644
--- a/app/views/users/index.html.erb
+++ b/app/views/users/index.html.erb
@@ -8,6 +8,7 @@
     <% end %>
   <% end %>
 </p>
+<p class="field_hint"><%= t(".admin_hint") %></p>
 
 <% UsersController::GROUP_ORDER.each do |group| %>
   <% members = @users[group] || [] %>