From 8bcacace28df52fd972c54e6850aa3b93f5c8bdf Mon Sep 17 00:00:00 2001 From: erdgeist Date: Sat, 1 Aug 2026 00:27:34 +0200 Subject: Declare role requirements per controller RoleRequired supplies require_redaktion and require_admin for surfaces that are not nodes and so cannot be reached by Node#restricted?. Navigation is content rather than plumbing, so menu_items requires redaktion. User management is janitorial and requires admin: index, new, create, reset_otp, deactivate, reactivate. verify_status now also covers show, without which any logged-in user could read any account by walking a small id space. Editing your own account stays open. The dashboard hides the Users and Navigation buttons from those who cannot use them; everything else stays visible to everyone. Both denials share one message and land on the dashboard. Adds redella (redaktion) and alufa (redaktion + alumni) fixtures. --- test/controllers/menu_items_controller_test.rb | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) (limited to 'test/controllers/menu_items_controller_test.rb') diff --git a/test/controllers/menu_items_controller_test.rb b/test/controllers/menu_items_controller_test.rb index 15a7b30b..d09198a3 100644 --- a/test/controllers/menu_items_controller_test.rb +++ b/test/controllers/menu_items_controller_test.rb @@ -9,7 +9,7 @@ class MenuItemsControllerTest < ActionController::TestCase end test "updating stores a title per locale" do - login_as :quentin + login_as :aaron item = create_menu_item patch :update, params: { :id => item.id, @@ -20,7 +20,7 @@ class MenuItemsControllerTest < ActionController::TestCase end test "blanking a non-default title falls back to the default locale" do - login_as :quentin + login_as :aaron item = create_menu_item patch :update, params: { :id => item.id, :menu_item => { :titles => { "de" => "Transparenz", "en" => "Transparency" } } } @@ -33,7 +33,7 @@ class MenuItemsControllerTest < ActionController::TestCase end test "a blank default title is rejected" do - login_as :quentin + login_as :aaron item = create_menu_item patch :update, params: { :id => item.id, :menu_item => { :titles => { "de" => "" } } } @@ -41,4 +41,11 @@ class MenuItemsControllerTest < ActionController::TestCase assert_response :success # re-rendered :edit, not a redirect assert_not_equal "", item.reload.translations.find_by(:locale => "de").title end + + test "an editor without redaktion cannot reach the menu" do + login_as :quentin + get :index + assert_redirected_to admin_path + assert_equal I18n.t("flash.common.redaktion_required"), flash[:error] + end end -- cgit v1.3