blob: 22ce625e3fa1b47ce2f89da952e2258b0e637188 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
|
# Controller-level role gates, for surfaces that are not nodes and so cannot
# be reached by Node#restricted?. The node gates live in the models, since
# those verbs are callable from rake tasks; these are HTTP-only.
module RoleRequired
extend ActiveSupport::Concern
private
def require_redaktion
return if current_user&.redaktion?
deny_role_access(:redaktion_required)
end
def require_admin
return if current_user&.is_admin?
deny_role_access(:admin_required)
end
def deny_role_access(key)
flash[:error] = t("flash.common.#{key}")
redirect_to admin_path
end
# require_admin must precede this in the filter chain, so a non-admin is
# denied by role before elevation is ever considered.
def require_elevation
return if elevated?
session[:elevation_return_to] = request.fullpath
redirect_to new_elevation_path
end
end
|
