Add simple auth to all admin-only controllers #837
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
solebared
commented
Jan 23, 2021
| @@ -67,7 +67,7 @@ def status | |||
| elsif matches_as_provider.any? | |||
| status = matches_as_provider.map{|m| m.completed?}.any? ? 'completed' : 'matched' | |||
| end | |||
| update_attributes(state: status) | |||
| update(state: status) | |||
There was a problem hiding this comment.
Gets rid of an annoying deprecation warning :)
solebared
commented
Jan 23, 2021
| @@ -13,7 +13,7 @@ | |||
| location_attributes: { zip: '12e45' }, | |||
| }} | |||
|
|
|||
| before { sign_in create(:user) } | |||
| before { sign_in create(:user, :admin) } | |||
There was a problem hiding this comment.
I believe ListingController is only currently used by admins?
10 tasks
solebared
force-pushed
the
inherit-admin-controller
branch
from
6cbf215
to
fc07237
Compare
Inheriting from AdminController gives us rudimentary authorization based on user role (must be admin or sysadmin). See #835. Also changes one occurrence of the deprecated `update_attributes` -> `update`.
solebared
force-pushed
the
inherit-admin-controller
branch
from
fc07237
to
050a237
Compare
maebeale
approved these changes
Jan 26, 2021
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Why
Gives all admin-only controllers rudimentary authorization by inheriting from
AdminController.See #835 for background.
Pre-Merge Checklist
Testing
This is part of the work to re-open user registration.
Once all that work is ready, we'll need to do some extensive manual regression testing.
Specific review requests
Most importantly, please check whether all these controllers are actually only for admin use.
Next Steps
?
Outstanding Questions, Concerns and Other Notes
?