From 8bcacace28df52fd972c54e6850aa3b93f5c8bdf Mon Sep 17 00:00:00 2001 From: erdgeist Date: Sat, 1 Aug 2026 00:27:34 +0200 Subject: Declare role requirements per controller RoleRequired supplies require_redaktion and require_admin for surfaces that are not nodes and so cannot be reached by Node#restricted?. Navigation is content rather than plumbing, so menu_items requires redaktion. User management is janitorial and requires admin: index, new, create, reset_otp, deactivate, reactivate. verify_status now also covers show, without which any logged-in user could read any account by walking a small id space. Editing your own account stays open. The dashboard hides the Users and Navigation buttons from those who cannot use them; everything else stays visible to everyone. Both denials share one message and land on the dashboard. Adds redella (redaktion) and alufa (redaktion + alumni) fixtures. --- app/controllers/concerns/role_required.rb | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) create mode 100644 app/controllers/concerns/role_required.rb (limited to 'app/controllers/concerns') diff --git a/app/controllers/concerns/role_required.rb b/app/controllers/concerns/role_required.rb new file mode 100644 index 00000000..b841b8cc --- /dev/null +++ b/app/controllers/concerns/role_required.rb @@ -0,0 +1,23 @@ +# Controller-level role gates, for surfaces that are not nodes and so cannot +# be reached by Node#restricted?. The node gates live in the models, since +# those verbs are callable from rake tasks; these are HTTP-only. +module RoleRequired + extend ActiveSupport::Concern + + private + + def require_redaktion + return if current_user&.redaktion? + deny_role_access(:redaktion_required) + end + + def require_admin + return if current_user&.is_admin? + deny_role_access(:admin_required) + end + + def deny_role_access(key) + flash[:error] = t("flash.common.#{key}") + redirect_to admin_path + end +end -- cgit v1.3