From 8bcacace28df52fd972c54e6850aa3b93f5c8bdf Mon Sep 17 00:00:00 2001 From: erdgeist Date: Sat, 1 Aug 2026 00:27:34 +0200 Subject: Declare role requirements per controller RoleRequired supplies require_redaktion and require_admin for surfaces that are not nodes and so cannot be reached by Node#restricted?. Navigation is content rather than plumbing, so menu_items requires redaktion. User management is janitorial and requires admin: index, new, create, reset_otp, deactivate, reactivate. verify_status now also covers show, without which any logged-in user could read any account by walking a small id space. Editing your own account stays open. The dashboard hides the Users and Navigation buttons from those who cannot use them; everything else stays visible to everyone. Both denials share one message and land on the dashboard. Adds redella (redaktion) and alufa (redaktion + alumni) fixtures. --- config/locales/de.yml | 2 ++ config/locales/en.yml | 2 ++ 2 files changed, 4 insertions(+) (limited to 'config/locales') diff --git a/config/locales/de.yml b/config/locales/de.yml index 74f6e8ae..04eb738e 100644 --- a/config/locales/de.yml +++ b/config/locales/de.yml @@ -574,6 +574,8 @@ de: headline_ineligible: "Dieser Asset-Typ kann kein Aufmacher sein." locked_by_other: "Die Seite ist gerade von jemand anderem gesperrt." autosave_failed: "Autosave fehlgeschlagen" + redaktion_required: "Diese Seite ist der Redaktion vorbehalten." + admin_required: "Diese Seite ist der Administration vorbehalten." sessions: otp_setup_now: "Dein Konto erfordert einen zweiten Faktor — richte ihn jetzt ein." logged_out: "Du wurdest abgemeldet." diff --git a/config/locales/en.yml b/config/locales/en.yml index c23f2c33..2f7ac72f 100644 --- a/config/locales/en.yml +++ b/config/locales/en.yml @@ -533,6 +533,8 @@ en: headline_ineligible: "This asset type cannot be a headline." locked_by_other: "The page is locked by another editor." autosave_failed: "Autosave failed" + redaktion_required: "This page is reserved for Redaktion." + admin_required: "This page is reserved for administrators." sessions: otp_setup_now: "Your account requires a second factor -- set it up now." logged_out: "You have been logged out." -- cgit v1.3