From 8bcacace28df52fd972c54e6850aa3b93f5c8bdf Mon Sep 17 00:00:00 2001
From: erdgeist <erdgeist@erdgeist.org>
Date: Sat, 1 Aug 2026 00:27:34 +0200
Subject: Declare role requirements per controller

RoleRequired supplies require_redaktion and require_admin for surfaces that
are not nodes and so cannot be reached by Node#restricted?.

Navigation is content rather than plumbing, so menu_items requires
redaktion. User management is janitorial and requires admin: index, new,
create, reset_otp, deactivate, reactivate. verify_status now also covers
show, without which any logged-in user could read any account by walking a
small id space. Editing your own account stays open.

The dashboard hides the Users and Navigation buttons from those who cannot
use them; everything else stays visible to everyone. Both denials share one
message and land on the dashboard.

Adds redella (redaktion) and alufa (redaktion + alumni) fixtures.
---
 app/controllers/concerns/role_required.rb | 23 +++++++++++++++++++++++
 app/controllers/menu_items_controller.rb  |  2 ++
 app/controllers/users_controller.rb       | 12 ++++--------
 app/views/admin/index.html.erb            | 12 ++++++++----
 4 files changed, 37 insertions(+), 12 deletions(-)
 create mode 100644 app/controllers/concerns/role_required.rb

(limited to 'app')

diff --git a/app/controllers/concerns/role_required.rb b/app/controllers/concerns/role_required.rb
new file mode 100644
index 00000000..b841b8cc
--- /dev/null
+++ b/app/controllers/concerns/role_required.rb
@@ -0,0 +1,23 @@
+# Controller-level role gates, for surfaces that are not nodes and so cannot
+# be reached by Node#restricted?. The node gates live in the models, since
+# those verbs are callable from rake tasks; these are HTTP-only.
+module RoleRequired
+  extend ActiveSupport::Concern
+
+  private
+
+    def require_redaktion
+      return if current_user&.redaktion?
+      deny_role_access(:redaktion_required)
+    end
+
+    def require_admin
+      return if current_user&.is_admin?
+      deny_role_access(:admin_required)
+    end
+
+    def deny_role_access(key)
+      flash[:error] = t("flash.common.#{key}")
+      redirect_to admin_path
+    end
+end
diff --git a/app/controllers/menu_items_controller.rb b/app/controllers/menu_items_controller.rb
index f169e0ca..63935f13 100644
--- a/app/controllers/menu_items_controller.rb
+++ b/app/controllers/menu_items_controller.rb
@@ -1,9 +1,11 @@
 class MenuItemsController < ApplicationController
   include PinnedToDefaultLocale
+  include RoleRequired
 
   # Private
 
   before_action :login_required
+  before_action :require_redaktion
   
   layout 'admin'
   
diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb
index 7bf23f17..052b2928 100644
--- a/app/controllers/users_controller.rb
+++ b/app/controllers/users_controller.rb
@@ -1,11 +1,13 @@
 class UsersController < ApplicationController
   include PinnedToDefaultLocale
+  include RoleRequired
 
   # Private
 
   before_action :login_required
   before_action :find_user,     :only => [:show, :edit, :update, :reset_otp, :deactivate, :reactivate]
-  before_action :verify_status, :except => [:index, :show]
+  before_action :require_admin, :only => [:index, :new, :create, :reset_otp, :deactivate, :reactivate]
+  before_action :verify_status, :except => [:index]
 
   layout 'admin'
 
@@ -54,8 +56,6 @@ class UsersController < ApplicationController
   end
 
   def deactivate
-    return deny_user_access unless current_user.is_admin?
-
     if @user == current_user
       flash[:error] = t("flash.users.cannot_deactivate_self")
     elsif @user.deactivate!(:actor => current_user)
@@ -66,8 +66,6 @@ class UsersController < ApplicationController
   end
 
   def reactivate
-    return deny_user_access unless current_user.is_admin?
-
     if @user.reactivate!(:actor => current_user)
       flash[:notice] = t("flash.users.reactivated", :login => @user.login)
     end
@@ -76,7 +74,6 @@ class UsersController < ApplicationController
   end
 
   def reset_otp
-    return deny_user_access unless current_user.admin?
     @user.disable_otp!(:actor => current_user)
     flash[:notice] = t("flash.users.otp_reset", :login => @user.login)
     redirect_to edit_user_path(@user)
@@ -106,7 +103,6 @@ class UsersController < ApplicationController
     end
 
     def deny_user_access
-      flash[:notice] = t("flash.common.admin_required")
-      redirect_to users_path
+      deny_role_access(:admin_required)
     end
 end
diff --git a/app/views/admin/index.html.erb b/app/views/admin/index.html.erb
index 984858e5..e3591c4e 100644
--- a/app/views/admin/index.html.erb
+++ b/app/views/admin/index.html.erb
@@ -71,11 +71,15 @@
     <%= link_to assets_path, class: "action_button" do %>
       <%= icon("folder", library: "tabler", "aria-hidden": true) %> <%= t("assets.index.title") %>
     <% end %>
-    <%= link_to users_path, class: "action_button" do %>
-      <%= icon("users", library: "tabler", "aria-hidden": true) %> <%= t("users.index.users") %>
+    <% if current_user.is_admin? %>
+      <%= link_to users_path, class: "action_button" do %>
+        <%= icon("users", library: "tabler", "aria-hidden": true) %> <%= t("users.index.title") %>
+      <% end %>
     <% end %>
-    <%= link_to menu_items_path, class: "action_button" do %>
-      <%= icon("menu-2", library: "tabler", "aria-hidden": true) %> <%= t(".navigation") %>
+    <% if current_user.redaktion? %>
+      <%= link_to menu_items_path, class: "action_button" do %>
+        <%= icon("menu-2", library: "tabler", "aria-hidden": true) %> <%= t(".navigation") %>
+      <% end %>
     <% end %>
     <% trash_count = Node.trash.children.count %>
     <%= link_to trashed_nodes_path, class: "action_button" do %>
-- 
cgit v1.3