From 8bcacace28df52fd972c54e6850aa3b93f5c8bdf Mon Sep 17 00:00:00 2001 From: erdgeist Date: Sat, 1 Aug 2026 00:27:34 +0200 Subject: Declare role requirements per controller RoleRequired supplies require_redaktion and require_admin for surfaces that are not nodes and so cannot be reached by Node#restricted?. Navigation is content rather than plumbing, so menu_items requires redaktion. User management is janitorial and requires admin: index, new, create, reset_otp, deactivate, reactivate. verify_status now also covers show, without which any logged-in user could read any account by walking a small id space. Editing your own account stays open. The dashboard hides the Users and Navigation buttons from those who cannot use them; everything else stays visible to everyone. Both denials share one message and land on the dashboard. Adds redella (redaktion) and alufa (redaktion + alumni) fixtures. --- test/fixtures/users.yml | 18 ++++++++++++++++++ 1 file changed, 18 insertions(+) (limited to 'test/fixtures') diff --git a/test/fixtures/users.yml b/test/fixtures/users.yml index f8d32d3c..2c433067 100644 --- a/test/fixtures/users.yml +++ b/test/fixtures/users.yml @@ -14,3 +14,21 @@ aaron: crypted_password: 740a48caf7dd5ff11318d812d57c0a0928cfbc12 # 'monkey' created_at: 2024-01-02 00:00:00 roles: ["admin", "redaktion"] + +redella: + id: 3 + login: redella + email: redella@example.com + salt: cf993996a70d31f924aff17a5f997722cb6ec2dd + crypted_password: 11c672158b0eb6e8c91c438b3eb844902308b138 # 'monkey' + created_at: 2024-01-03 00:00:00 + roles: ["redaktion"] + +alufa: + id: 4 + login: alufa + email: alufa@example.com + salt: cf993996a70d31f924aff17a5f997722cb6ec2dd + crypted_password: 11c672158b0eb6e8c91c438b3eb844902308b138 # 'monkey' + created_at: 2024-01-04 00:00:00 + roles: ["redaktion", "alumni"] -- cgit v1.3