Declare role requirements per controller

RoleRequired supplies require_redaktion and require_admin for surfaces that
are not nodes and so cannot be reached by Node#restricted?.

Navigation is content rather than plumbing, so menu_items requires
redaktion. User management is janitorial and requires admin: index, new,
create, reset_otp, deactivate, reactivate. verify_status now also covers
show, without which any logged-in user could read any account by walking a
small id space. Editing your own account stays open.

The dashboard hides the Users and Navigation buttons from those who cannot
use them; everything else stays visible to everyone. Both denials share one
message and land on the dashboard.

Adds redella (redaktion) and alufa (redaktion + alumni) fixtures.

1 files changed, 18 insertions, 0 deletions

diff --git a/test/fixtures/users.yml b/test/fixtures/users.yml
index f8d32d3c..2c433067 100644
--- a/test/fixtures/users.yml
+++ b/test/fixtures/users.yml
@@ -14,3 +14,21 @@ aaron:
   crypted_password:          740a48caf7dd5ff11318d812d57c0a0928cfbc12 # 'monkey'
   created_at:                2024-01-02 00:00:00
   roles:                     ["admin", "redaktion"]
+
+redella:
+  id:                        3
+  login:                     redella
+  email:                     redella@example.com
+  salt:                      cf993996a70d31f924aff17a5f997722cb6ec2dd
+  crypted_password:          11c672158b0eb6e8c91c438b3eb844902308b138 # 'monkey'
+  created_at:                2024-01-03 00:00:00
+  roles:                     ["redaktion"]
+
+alufa:
+  id:                        4
+  login:                     alufa
+  email:                     alufa@example.com
+  salt:                      cf993996a70d31f924aff17a5f997722cb6ec2dd
+  crypted_password:          11c672158b0eb6e8c91c438b3eb844902308b138 # 'monkey'
+  created_at:                2024-01-04 00:00:00
+  roles:                     ["redaktion", "alumni"]