Declare role requirements per controller

RoleRequired supplies require_redaktion and require_admin for surfaces that
are not nodes and so cannot be reached by Node#restricted?.

Navigation is content rather than plumbing, so menu_items requires
redaktion. User management is janitorial and requires admin: index, new,
create, reset_otp, deactivate, reactivate. verify_status now also covers
show, without which any logged-in user could read any account by walking a
small id space. Editing your own account stays open.

The dashboard hides the Users and Navigation buttons from those who cannot
use them; everything else stays visible to everyone. Both denials share one
message and land on the dashboard.

Adds redella (redaktion) and alufa (redaktion + alumni) fixtures.

1 files changed, 2 insertions, 0 deletions

diff --git a/app/controllers/menu_items_controller.rb b/app/controllers/menu_items_controller.rb
index f169e0ca..63935f13 100644
--- a/app/controllers/menu_items_controller.rb
+++ b/app/controllers/menu_items_controller.rb
@@ -1,9 +1,11 @@
 class MenuItemsController < ApplicationController
   include PinnedToDefaultLocale
+  include RoleRequired
 
   # Private
 
   before_action :login_required
+  before_action :require_redaktion
   
   layout 'admin'