Declare role requirements per controller

RoleRequired supplies require_redaktion and require_admin for surfaces that
are not nodes and so cannot be reached by Node#restricted?.

Navigation is content rather than plumbing, so menu_items requires
redaktion. User management is janitorial and requires admin: index, new,
create, reset_otp, deactivate, reactivate. verify_status now also covers
show, without which any logged-in user could read any account by walking a
small id space. Editing your own account stays open.

The dashboard hides the Users and Navigation buttons from those who cannot
use them; everything else stays visible to everyone. Both denials share one
message and land on the dashboard.

Adds redella (redaktion) and alufa (redaktion + alumni) fixtures.

1 files changed, 23 insertions, 0 deletions

diff --git a/app/controllers/concerns/role_required.rb b/app/controllers/concerns/role_required.rb
new file mode 100644
index 00000000..b841b8cc
--- /dev/null
+++ b/app/controllers/concerns/role_required.rb
@@ -0,0 +1,23 @@
+# Controller-level role gates, for surfaces that are not nodes and so cannot
+# be reached by Node#restricted?. The node gates live in the models, since
+# those verbs are callable from rake tasks; these are HTTP-only.
+module RoleRequired
+  extend ActiveSupport::Concern
+
+  private
+
+    def require_redaktion
+      return if current_user&.redaktion?
+      deny_role_access(:redaktion_required)
+    end
+
+    def require_admin
+      return if current_user&.is_admin?
+      deny_role_access(:admin_required)
+    end
+
+    def deny_role_access(key)
+      flash[:error] = t("flash.common.#{key}")
+      redirect_to admin_path
+    end
+end