Authorisation

[drobny]

At the minute it looks like there is no restriction (based on being an admin or not)

• What posts etc. can be viewed based on current role
• Editing of other posts based on role

Can we add some hand rolled authorisation to the app (and tests) to fulfil the following conditions

• Any user can sign up for the site and create a post
• Any user can view any post on the site
• Users can also edit their own post
• Normal users can’t edit posts created by other users
• Admin users can edit any post in the system

Remember to think about access at a view / controller level

[Megan-Ralph]

Hey Rob,

I already had some (very small) existing functionality for admin users so I have built on that in these two commits (here and here). I have also left in a tiny spec here.

In these commits I added the following:

• Ability for admins to edit any posts (if I had more time I would add the ability for admins to edit comments too!)
• Ability to see which admin edited a post and when
• Ability for admins to delete any posts (and any comments associated with them)
• Prevention for normal users to edit any post other than their own