Group user accounts by role

Replaces the two-way admin/user split with four groups ordered by
capability: administration, Redaktion, editors, alumni. alumni takes
precedence over capability in role_group, so a retired admin appears at the
bottom rather than the top.

Forms now offer the three roles as checkboxes rather than a single admin
checkbox, with a trailing hidden blank so an empty set can be posted, and
user_params permits roles only for admins. Three create buttons prefill the
common combinations.

2 files changed, 50 insertions, 8 deletions

diff --git a/config/locales/de.yml b/config/locales/de.yml
index cf93e05b..e15a08d2 100644
--- a/config/locales/de.yml
+++ b/config/locales/de.yml
@@ -145,6 +145,10 @@ de:
               restore_target_invalid: "Das Wiederherstellungsziel muss ein lebender Node sein"
               destroy_outside_trash: "Nodes können nur aus dem Papierkorb gelöscht werden"
               attach_in_trash: "An einen Node im Papierkorb können keine Assets angehängt werden"
+        user:
+          attributes:
+            roles:
+              unknown: "enthält unbekannte Rollen: %{list}"
         related_asset:
           attributes:
             headline:
@@ -276,11 +280,28 @@ de:
       admin: "Admin?"
     user:
       confirm_destroy: "Benutzer %{login} wirklich löschen?"
+      no_roles: "—"
     index:
-      admins: "Admins"
-      create_admin: "Admin-Benutzer anlegen"
-      users: "Benutzer"
-      create_user: "Benutzer anlegen"
+      title: "Benutzerkonten"
+      create_editor: "Editor-Konto anlegen"
+      create_redaktion: "Redaktions-Konto anlegen"
+      create_admin: "Admin-Konto anlegen"
+      group_admin: "Administration"
+      group_redaktion: "Redaktion"
+      group_editor: "Editors"
+      group_alumni: "Ehemalige"
+      group_empty: "— keine —"
+    labels:
+      roles: "Rollen"
+    roles:
+      admin: "Administration"
+      redaktion: "Redaktion"
+      alumni: "Ehemalig"
+    role_hints:
+      admin: "Benutzerverwaltung und Navigation, jeweils nach erneuter Bestätigung."
+      redaktion: "Darf in den geschützten Bereichen veröffentlichen."
+      alumni: "Kein Login mehr möglich; Zuschreibungen bleiben erhalten."
+    no_roles: "keine besonderen Rollen"
     new:
       title: "Neuen Benutzer anlegen"
 
diff --git a/config/locales/en.yml b/config/locales/en.yml
index c3f515b5..f8b94a00 100644
--- a/config/locales/en.yml
+++ b/config/locales/en.yml
@@ -92,6 +92,10 @@ en:
               restore_target_invalid: "Restore target must be a living node"
               destroy_outside_trash: "Nodes are only destroyed from the Trash"
               attach_in_trash: "Cannot attach assets to a node in the Trash"
+        user:
+          attributes:
+            roles:
+              unknown: "contains unknown roles: %{list}"
         related_asset:
           attributes:
             headline:
@@ -224,11 +228,28 @@ en:
       admin: "admin?"
     user:
       confirm_destroy: "Do you really want to destroy user %{login}?"
+      no_roles: "—"
     index:
-      admins: "Admins"
-      create_admin: "Create admin user"
-      users: "Users"
-      create_user: "Create user"
+      title: "User accounts"
+      create_editor: "Create editor account"
+      create_redaktion: "Create Redaktion account"
+      create_admin: "Create admin account"
+      group_admin: "Administration"
+      group_redaktion: "Redaktion"
+      group_editor: "Editors"
+      group_alumni: "Alumni"
+      group_empty: "— none —"
+    labels:
+      roles: "Roles"
+    roles:
+      admin: "Administration"
+      redaktion: "Redaktion"
+      alumni: "Alumnus"
+    role_hints:
+      admin: "User management and navigation, each behind a fresh confirmation."
+      redaktion: "May publish in the protected sections."
+      alumni: "Can no longer log in; attributions are preserved."
+    no_roles: "no special roles"
     new:
       title: "Create new user"