From 8bcacace28df52fd972c54e6850aa3b93f5c8bdf Mon Sep 17 00:00:00 2001 From: erdgeist Date: Sat, 1 Aug 2026 00:27:34 +0200 Subject: Declare role requirements per controller RoleRequired supplies require_redaktion and require_admin for surfaces that are not nodes and so cannot be reached by Node#restricted?. Navigation is content rather than plumbing, so menu_items requires redaktion. User management is janitorial and requires admin: index, new, create, reset_otp, deactivate, reactivate. verify_status now also covers show, without which any logged-in user could read any account by walking a small id space. Editing your own account stays open. The dashboard hides the Users and Navigation buttons from those who cannot use them; everything else stays visible to everyone. Both denials share one message and land on the dashboard. Adds redella (redaktion) and alufa (redaktion + alumni) fixtures. --- app/views/admin/index.html.erb | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) (limited to 'app/views/admin') diff --git a/app/views/admin/index.html.erb b/app/views/admin/index.html.erb index 984858e5..e3591c4e 100644 --- a/app/views/admin/index.html.erb +++ b/app/views/admin/index.html.erb @@ -71,11 +71,15 @@ <%= link_to assets_path, class: "action_button" do %> <%= icon("folder", library: "tabler", "aria-hidden": true) %> <%= t("assets.index.title") %> <% end %> - <%= link_to users_path, class: "action_button" do %> - <%= icon("users", library: "tabler", "aria-hidden": true) %> <%= t("users.index.users") %> + <% if current_user.is_admin? %> + <%= link_to users_path, class: "action_button" do %> + <%= icon("users", library: "tabler", "aria-hidden": true) %> <%= t("users.index.title") %> + <% end %> <% end %> - <%= link_to menu_items_path, class: "action_button" do %> - <%= icon("menu-2", library: "tabler", "aria-hidden": true) %> <%= t(".navigation") %> + <% if current_user.redaktion? %> + <%= link_to menu_items_path, class: "action_button" do %> + <%= icon("menu-2", library: "tabler", "aria-hidden": true) %> <%= t(".navigation") %> + <% end %> <% end %> <% trash_count = Node.trash.children.count %> <%= link_to trashed_nodes_path, class: "action_button" do %> -- cgit v1.3