make ban deletions admin-only

lib/philomena_web/controllers/admin/fingerprint_ban_controller.ex

@@ -8,6 +8,7 @@ defmodule PhilomenaWeb.Admin.FingerprintBanController do
 
   plug :verify_authorized
   plug :load_resource, model: FingerprintBan, only: [:edit, :update, :delete]
+  plug :check_can_delete when action in [:delete]
 
   def index(conn, %{"q" => q}) when is_binary(q) do
     FingerprintBan
@@ -98,4 +99,11 @@ defmodule PhilomenaWeb.Admin.FingerprintBanController do
       false -> PhilomenaWeb.NotAuthorizedPlug.call(conn)
     end
   end
+
+  defp check_can_delete(conn, _opts) do
+    case conn.assigns.current_user.role == "admin" do
+      true -> conn
+      false -> PhilomenaWeb.NotAuthorizedPlug.call(conn)
+    end
+  end
 end

lib/philomena_web/controllers/admin/subnet_ban_controller.ex

@@ -8,6 +8,7 @@ defmodule PhilomenaWeb.Admin.SubnetBanController do
 
   plug :verify_authorized
   plug :load_resource, model: SubnetBan, only: [:edit, :update, :delete]
+  plug :check_can_delete when action in [:delete]
 
   def index(conn, %{"q" => q}) when is_binary(q) do
     SubnetBan
@@ -100,4 +101,11 @@ defmodule PhilomenaWeb.Admin.SubnetBanController do
       false -> PhilomenaWeb.NotAuthorizedPlug.call(conn)
     end
   end
+
+  defp check_can_delete(conn, _opts) do
+    case conn.assigns.current_user.role == "admin" do
+      true -> conn
+      false -> PhilomenaWeb.NotAuthorizedPlug.call(conn)
+    end
+  end
 end

lib/philomena_web/controllers/admin/user_ban_controller.ex

@@ -8,6 +8,7 @@ defmodule PhilomenaWeb.Admin.UserBanController do
 
   plug :verify_authorized
   plug :load_resource, model: UserBan, only: [:edit, :update, :delete]
+  plug :check_can_delete when action in [:delete]
 
   def index(conn, %{"q" => q}) when is_binary(q) do
     like_q = "%#{q}%"
@@ -101,4 +102,11 @@ defmodule PhilomenaWeb.Admin.UserBanController do
       false -> PhilomenaWeb.NotAuthorizedPlug.call(conn)
     end
   end
+
+  defp check_can_delete(conn, _opts) do
+    case conn.assigns.current_user.role == "admin" do
+      true -> conn
+      false -> PhilomenaWeb.NotAuthorizedPlug.call(conn)
+    end
+  end
 end

lib/philomena_web/templates/admin/fingerprint_ban/index.html.slime

@@ -54,8 +54,9 @@ h1 Fingerprint Bans
 
             td
                 => link "Edit", to: Routes.admin_fingerprint_ban_path(@conn, :edit, ban)
-                ' •
+                = if @current_user.role == "admin" do
-                => link "Destroy", to: Routes.admin_fingerprint_ban_path(@conn, :delete, ban), data: [confirm: "Are you really, really sure?", method: "delete"]
+                  ' •
+                  => link "Destroy", to: Routes.admin_fingerprint_ban_path(@conn, :delete, ban), data: [confirm: "Are you really, really sure?", method: "delete"]
 
   .block__header.block__header--light
     = pagination

lib/philomena_web/templates/admin/subnet_ban/index.html.slime

@@ -54,8 +54,9 @@ h1 Subnet Bans
 
             td
                 => link "Edit", to: Routes.admin_subnet_ban_path(@conn, :edit, ban)
-                ' •
+                = if @current_user.role == "admin" do
-                => link "Destroy", to: Routes.admin_subnet_ban_path(@conn, :delete, ban), data: [confirm: "Are you really, really sure?", method: "delete"]
+                  ' •
+                  => link "Destroy", to: Routes.admin_subnet_ban_path(@conn, :delete, ban), data: [confirm: "Are you really, really sure?", method: "delete"]
 
   .block__header.block__header--light
     = pagination

lib/philomena_web/templates/admin/user_ban/index.html.slime

@@ -54,8 +54,9 @@ h1 User Bans
 
             td
                 => link "Edit", to: Routes.admin_user_ban_path(@conn, :edit, ban)
-                ' •
+                = if @current_user.role == "admin" do
-                => link "Destroy", to: Routes.admin_user_ban_path(@conn, :delete, ban), data: [confirm: "Are you really, really sure?", method: "delete"]
+                  ' •
+                  => link "Destroy", to: Routes.admin_user_ban_path(@conn, :delete, ban), data: [confirm: "Are you really, really sure?", method: "delete"]
 
   .block__header.block__header--light
     = pagination