Authorize access to admin panel, etc.

Adds a separate admin namespace and base controller, with authorization
by looking up the admin property in the user's LDAP account.

app/assets/stylesheets/fonts.scss

@@ -5,8 +5,19 @@
   font-style: normal;
 }
 
-h1 {
-  font-family: Raleway, sans-serif;
+body {
+  font-family: "Open Sans", Helvetica, Arial, sans-serif;
+  font-weight: 400;
+}
+
+h1, h2, h3 {
+  font-family: Raleway, inherit;
   font-weight: 300;
+}
+
+h1 {
   text-transform: uppercase;
 }
+
+h2 {
+}

app/assets/stylesheets/layout.scss

@@ -2,8 +2,6 @@ $content-width: 800px;
 $content-max-width: 100%;
 
 body {
-  font-family: "Open Sans", Helvetica, Arial, sans-serif;
-  font-weight: 400;
 }
 
 #wrapper {

app/controllers/admin/base_controller.rb

@@ -0,0 +1,6 @@
+class Admin::BaseController < ApplicationController
+
+  before_action :authenticate_user!
+  before_action :authorize_admin
+
+end

app/controllers/admin/dashboard_controller.rb

@@ -0,0 +1,4 @@
+class Admin::DashboardController < Admin::BaseController
+  def index
+  end
+end

app/controllers/admin/ldap_users_controller.rb

@@ -1,4 +1,4 @@
-class LdapUsersController < ApplicationController
+class Admin::LdapUsersController < Admin::BaseController
   def index
     attributes = %w{dn cn uid mail admin}
     filter = Net::LDAP::Filter.eq("uid", "*")

app/controllers/application_controller.rb

@@ -8,4 +8,15 @@ class ApplicationController < ActionController::Base
       redirect_to welcome_path and return
     end
   end
+
+  def authorize_admin
+    http_status :forbidden unless current_user.is_admin?
+  end
+
+  def http_status(status)
+    respond_to do |format|
+      format.html { render template: "shared/status_#{status.to_s}", status: status }
+      format.any  { head status }
+    end
+  end
 end

app/models/user.rb

@@ -19,4 +19,12 @@ class User < ApplicationRecord
     clear_reset_password_token if valid?
     save
   end
+
+  def is_admin?
+    admin ||= if admin = Devise::LDAP::Adapter.get_ldap_param(self.cn, :admin)
+                !!admin.first
+              else
+                false
+              end
+  end
 end

app/views/admin/dashboard/index.html.erb

@@ -0,0 +1,4 @@
+<h2>Admin Panel</h2>
+<p>
+  Ohai there, admin human.
+</p>

app/views/admin/ldap_users/index.html.erb

@@ -1,8 +1,8 @@
 <h2>LDAP users</h2>
 
 <ul>
-  <li><%= link_to 'kosmos.org', ldap_users_path %></li>
-  <li><%= link_to '5apps.com', ldap_users_path(ou: '5apps.com') %></li>
+  <li><%= link_to 'kosmos.org', admin_ldap_users_path %></li>
+  <li><%= link_to '5apps.com', admin_ldap_users_path(ou: '5apps.com') %></li>
 </ul>
 
 <table>

app/views/shared/status_forbidden.html.erb

@@ -0,0 +1,2 @@
+<h2>Access forbidden</h2>
+<p>Not with those shoes, buddy.</p>