From 9808da44f2a082e0825e7261d0943c89e2fd78e3 Mon Sep 17 00:00:00 2001 From: Edimo Silva Date: Sat, 25 May 2024 17:44:08 -0300 Subject: [PATCH 1/2] 190: Only allow admin users to access admin dashboard --- .../admin/application_controller.rb | 23 +++++-- .../app/policies/admin_dashboard_policy.rb | 11 ++++ backend/public/401.html | 66 +++++++++++++++++++ backend/public/403.html | 66 +++++++++++++++++++ backend/public/404.html | 5 +- 5 files changed, 162 insertions(+), 9 deletions(-) create mode 100644 backend/app/policies/admin_dashboard_policy.rb create mode 100644 backend/public/401.html create mode 100644 backend/public/403.html diff --git a/backend/app/controllers/admin/application_controller.rb b/backend/app/controllers/admin/application_controller.rb index 534540e..50e2181 100644 --- a/backend/app/controllers/admin/application_controller.rb +++ b/backend/app/controllers/admin/application_controller.rb @@ -8,17 +8,28 @@ # you're free to overwrite the RESTful controller actions. module Admin class ApplicationController < Administrate::ApplicationController + before_action :authenticate_user! before_action :authenticate_admin before_action :set_paper_trail_whodunnit + rescue_from Pundit::NotAuthorizedError, with: :user_not_authorized + + include Pundit::Authorization + after_action :verify_authorized + def authenticate_admin - # TODO: Add authentication logic here. + authorize :admin_dashboard, :full_access? + + # authorized = AdminDashboardPolicy.new(current_user, nil).send(:admin_dashboard?) + # raise Pundit::NotAuthorizedError unless authorized end + private - # Override this value to specify the number of elements to display at a time - # on index pages. Defaults to 20. - # def records_per_page - # params[:per_page] || 20 - # end + def user_not_authorized(exception) + policy_name = exception.policy.class.to_s.underscore + flash[:error] = t "#{policy_name}.#{exception.query}", scope: "pundit", default: :default + render file: "#{Rails.root}/public/401.html", layout: false, status: 401 + + end end end diff --git a/backend/app/policies/admin_dashboard_policy.rb b/backend/app/policies/admin_dashboard_policy.rb new file mode 100644 index 0000000..203b21a --- /dev/null +++ b/backend/app/policies/admin_dashboard_policy.rb @@ -0,0 +1,11 @@ +# frozen_string_literal: true + +class AdminDashboardPolicy < ApplicationPolicy + def initialize(user, _record) + @user = user + end + + def full_access? + user.admin? + end +end diff --git a/backend/public/401.html b/backend/public/401.html new file mode 100644 index 0000000..b6a29c3 --- /dev/null +++ b/backend/public/401.html @@ -0,0 +1,66 @@ + + + + The page you were looking for doesn't exist (401) + + + + + + +
+
+

You have no permission.

+
+

Check if you have the correct roles.

+
+ + diff --git a/backend/public/403.html b/backend/public/403.html new file mode 100644 index 0000000..e2b35f9 --- /dev/null +++ b/backend/public/403.html @@ -0,0 +1,66 @@ + + + + Forbidden + + + + + +
+
+

The page you were looking for doesn't exist.

+

You may have mistyped the address or the page may have moved.

+
+

If you are the application owner check the logs for more information.

+
+ + diff --git a/backend/public/404.html b/backend/public/404.html index 2be3af2..9c574ce 100644 --- a/backend/public/404.html +++ b/backend/public/404.html @@ -58,10 +58,9 @@
-

The page you were looking for doesn't exist.

-

You may have mistyped the address or the page may have moved.

+

Unauthorized

+

You need to sign in.

-

If you are the application owner check the logs for more information.

From 8af9b82a799e00eb4e76347f83aa569e79313557 Mon Sep 17 00:00:00 2001 From: Edimo Silva Date: Sat, 25 May 2024 17:48:08 -0300 Subject: [PATCH 2/2] 190: Fix cops --- backend/app/controllers/admin/application_controller.rb | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/backend/app/controllers/admin/application_controller.rb b/backend/app/controllers/admin/application_controller.rb index 50e2181..bb345ac 100644 --- a/backend/app/controllers/admin/application_controller.rb +++ b/backend/app/controllers/admin/application_controller.rb @@ -23,13 +23,13 @@ def authenticate_admin # authorized = AdminDashboardPolicy.new(current_user, nil).send(:admin_dashboard?) # raise Pundit::NotAuthorizedError unless authorized end + private def user_not_authorized(exception) policy_name = exception.policy.class.to_s.underscore - flash[:error] = t "#{policy_name}.#{exception.query}", scope: "pundit", default: :default - render file: "#{Rails.root}/public/401.html", layout: false, status: 401 - + flash.now[:error] = t "#{policy_name}.#{exception.query}", scope: "pundit", default: :default + render file: Rails.public_path.join("401.html").to_s, layout: false, status: :unauthorized end end end