3 files changed, 29 insertions, 8 deletions

diff --git a/app/controllers/concerns/role_required.rb b/app/controllers/concerns/role_required.rb
new file mode 100644
index 00000000..b841b8cc
--- /dev/null
+++ b/app/controllers/concerns/role_required.rb
@@ -0,0 +1,23 @@
+# Controller-level role gates, for surfaces that are not nodes and so cannot
+# be reached by Node#restricted?. The node gates live in the models, since
+# those verbs are callable from rake tasks; these are HTTP-only.
+module RoleRequired
+  extend ActiveSupport::Concern
+
+  private
+
+    def require_redaktion
+      return if current_user&.redaktion?
+      deny_role_access(:redaktion_required)
+    end
+
+    def require_admin
+      return if current_user&.is_admin?
+      deny_role_access(:admin_required)
+    end
+
+    def deny_role_access(key)
+      flash[:error] = t("flash.common.#{key}")
+      redirect_to admin_path
+    end
+end
diff --git a/app/controllers/menu_items_controller.rb b/app/controllers/menu_items_controller.rb
index f169e0ca..63935f13 100644
--- a/app/controllers/menu_items_controller.rb
+++ b/app/controllers/menu_items_controller.rb
@@ -1,9 +1,11 @@
 class MenuItemsController < ApplicationController
   include PinnedToDefaultLocale
+  include RoleRequired
 
   # Private
 
   before_action :login_required
+  before_action :require_redaktion
   
   layout 'admin'
   
diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb
index 7bf23f17..052b2928 100644
--- a/app/controllers/users_controller.rb
+++ b/app/controllers/users_controller.rb
@@ -1,11 +1,13 @@
 class UsersController < ApplicationController
   include PinnedToDefaultLocale
+  include RoleRequired
 
   # Private
 
   before_action :login_required
   before_action :find_user,     :only => [:show, :edit, :update, :reset_otp, :deactivate, :reactivate]
-  before_action :verify_status, :except => [:index, :show]
+  before_action :require_admin, :only => [:index, :new, :create, :reset_otp, :deactivate, :reactivate]
+  before_action :verify_status, :except => [:index]
 
   layout 'admin'
 
@@ -54,8 +56,6 @@ class UsersController < ApplicationController
   end
 
   def deactivate
-    return deny_user_access unless current_user.is_admin?
-
     if @user == current_user
       flash[:error] = t("flash.users.cannot_deactivate_self")
     elsif @user.deactivate!(:actor => current_user)
@@ -66,8 +66,6 @@ class UsersController < ApplicationController
   end
 
   def reactivate
-    return deny_user_access unless current_user.is_admin?
-
     if @user.reactivate!(:actor => current_user)
       flash[:notice] = t("flash.users.reactivated", :login => @user.login)
     end
@@ -76,7 +74,6 @@ class UsersController < ApplicationController
   end
 
   def reset_otp
-    return deny_user_access unless current_user.admin?
     @user.disable_otp!(:actor => current_user)
     flash[:notice] = t("flash.users.otp_reset", :login => @user.login)
     redirect_to edit_user_path(@user)
@@ -106,7 +103,6 @@ class UsersController < ApplicationController
     end
 
     def deny_user_access
-      flash[:notice] = t("flash.common.admin_required")
-      redirect_to users_path
+      deny_role_access(:admin_required)
     end
 end