diff options
| author | erdgeist <erdgeist@erdgeist.org> | 2026-08-01 00:27:34 +0200 |
|---|---|---|
| committer | erdgeist <erdgeist@erdgeist.org> | 2026-08-01 00:27:34 +0200 |
| commit | 8bcacace28df52fd972c54e6850aa3b93f5c8bdf (patch) | |
| tree | 05e90dd4e8f31ebb142f66239025da15e873901f /app/controllers/assets_controller.rb | |
| parent | 529f81b28ed77c62acaa63fad957e751798f2440 (diff) | |
Declare role requirements per controller
RoleRequired supplies require_redaktion and require_admin for surfaces that
are not nodes and so cannot be reached by Node#restricted?.
Navigation is content rather than plumbing, so menu_items requires
redaktion. User management is janitorial and requires admin: index, new,
create, reset_otp, deactivate, reactivate. verify_status now also covers
show, without which any logged-in user could read any account by walking a
small id space. Editing your own account stays open.
The dashboard hides the Users and Navigation buttons from those who cannot
use them; everything else stays visible to everyone. Both denials share one
message and land on the dashboard.
Adds redella (redaktion) and alufa (redaktion + alumni) fixtures.
Diffstat (limited to 'app/controllers/assets_controller.rb')
0 files changed, 0 insertions, 0 deletions