Declare role requirements per controller

RoleRequired supplies require_redaktion and require_admin for surfaces that
are not nodes and so cannot be reached by Node#restricted?.

Navigation is content rather than plumbing, so menu_items requires
redaktion. User management is janitorial and requires admin: index, new,
create, reset_otp, deactivate, reactivate. verify_status now also covers
show, without which any logged-in user could read any account by walking a
small id space. Editing your own account stays open.

The dashboard hides the Users and Navigation buttons from those who cannot
use them; everything else stays visible to everyone. Both denials share one
message and land on the dashboard.

Adds redella (redaktion) and alufa (redaktion + alumni) fixtures.

1 files changed, 10 insertions, 3 deletions

diff --git a/test/controllers/menu_items_controller_test.rb b/test/controllers/menu_items_controller_test.rb
index 15a7b30b..d09198a3 100644
--- a/test/controllers/menu_items_controller_test.rb
+++ b/test/controllers/menu_items_controller_test.rb
@@ -9,7 +9,7 @@ class MenuItemsControllerTest < ActionController::TestCase
   end
 
   test "updating stores a title per locale" do
-    login_as :quentin
+    login_as :aaron
     item = create_menu_item
 
     patch :update, params: { :id => item.id,
@@ -20,7 +20,7 @@ class MenuItemsControllerTest < ActionController::TestCase
   end
 
   test "blanking a non-default title falls back to the default locale" do
-    login_as :quentin
+    login_as :aaron
     item = create_menu_item
     patch :update, params: { :id => item.id,
       :menu_item => { :titles => { "de" => "Transparenz", "en" => "Transparency" } } }
@@ -33,7 +33,7 @@ class MenuItemsControllerTest < ActionController::TestCase
   end
 
   test "a blank default title is rejected" do
-    login_as :quentin
+    login_as :aaron
     item = create_menu_item
     patch :update, params: { :id => item.id,
       :menu_item => { :titles => { "de" => "" } } }
@@ -41,4 +41,11 @@ class MenuItemsControllerTest < ActionController::TestCase
     assert_response :success        # re-rendered :edit, not a redirect
     assert_not_equal "", item.reload.translations.find_by(:locale => "de").title
   end
+
+  test "an editor without redaktion cannot reach the menu" do
+    login_as :quentin
+    get :index
+    assert_redirected_to admin_path
+    assert_equal I18n.t("flash.common.redaktion_required"), flash[:error]
+  end
 end