Only show menu when authenticated and only show user management when logged in as admin

source/calendarwebapp/authenticator.d

@@ -64,8 +64,9 @@ public:
     }
 }
 
-enum Role
+enum Privilege
 {
+    None,
     User,
     Admin
 }
@@ -77,7 +78,7 @@ struct AuthInfo
     @name("_id") BsonObjectID id;
     string username;
     string passwordHash;
-    Role role;
+    Privilege privilege;
 
     mixin(generateAuthMethods);
 
@@ -89,12 +90,12 @@ private:
         import std.traits : EnumMembers;
 
         string ret;
-        foreach (member; EnumMembers!Role)
+        foreach (member; EnumMembers!Privilege)
         {
             ret ~= q{
                 bool is%s() const pure @safe nothrow
                 {
-                    return role == Role.%s;
+                    return privilege == Privilege.%s;
                 }
             }.format(member.to!string, member.to!string);
         }

source/calendarwebapp/calendarwebapp.d

@@ -2,7 +2,7 @@ module calendarwebapp.calendarwebapp;
 
 import botan.rng.rng : RandomNumberGenerator;
 
-import calendarwebapp.authenticator : Authenticator, AuthInfo, Privilege = Role;
+import calendarwebapp.authenticator;
 import calendarwebapp.event;
 
 import core.time : days;
@@ -25,24 +25,24 @@ import vibe.web.web : errorDisplay, noRoute, redirect, render, SessionVar,
 {
     @noRoute AuthInfo authenticate(scope HTTPServerRequest req, scope HTTPServerResponse) @safe
     {
-        if (!req.session || !req.session.isKeySet("authInfo"))
-        {
+        if (authInfo.value.isNone)
             redirect("/login");
-            return AuthInfo.init;
-        }
-        return req.session.get!AuthInfo("authInfo");
+
+        return authInfo.value;
     }
 
 public:
-    @anyAuth void index()
+    @auth(Role.user | Role.admin) void index()
     {
         auto events = eventStore.getAllEvents();
-        render!("showevents.dt", events);
+        auto authInfo = this.authInfo.value;
+        render!("showevents.dt", events, authInfo);
     }
 
     @noAuth void getLogin(string _error = null)
     {
-        render!("login.dt", _error);
+        auto authInfo = this.authInfo.value;
+        render!("login.dt", _error, authInfo);
     }
 
     @noAuth @errorDisplay!getLogin void postLogin(string username, string password) @safe
@@ -53,18 +53,20 @@ public:
         redirect("/");
     }
 
-    @anyAuth void getLogout() @safe
+    @auth(Role.user | Role.admin) void getLogout() @safe
     {
         terminateSession();
         redirect("/");
     }
 
-    @anyAuth void getCreateevent(ValidationErrorData _error = ValidationErrorData.init)
+    @auth(Role.user | Role.admin) void getCreateevent(
+            ValidationErrorData _error = ValidationErrorData.init)
     {
-        render!("createevent.dt", _error);
+        auto authInfo = this.authInfo.value;
+        render!("createevent.dt", _error, authInfo);
     }
 
-    @anyAuth @errorDisplay!getCreateevent void postCreateevent(Date begin,
+    @auth(Role.user | Role.admin) @errorDisplay!getCreateevent void postCreateevent(Date begin,
             Nullable!Date end, string description, string name, EventType type, bool shout) @safe
     {
         import std.array : replace, split;
@@ -80,7 +82,7 @@ public:
         redirect("/");
     }
 
-    @anyAuth void postRemoveevent(BsonObjectID id) @safe
+    @auth(Role.user | Role.admin) void postRemoveevent(BsonObjectID id) @safe
     {
         eventStore.removeEvent(id);
         redirect("/");
@@ -89,7 +91,8 @@ public:
     @auth(Role.admin) void getUsers()
     {
         auto users = authenticator.getAllUsers;
-        render!("showusers.dt", users);
+        auto authInfo = this.authInfo.value;
+        render!("showusers.dt", users, authInfo);
     }
 
     @auth(Role.admin) void postRemoveuser(BsonObjectID id) @safe
@@ -100,7 +103,8 @@ public:
 
     @auth(Role.admin) void getCreateuser(ValidationErrorData _error = ValidationErrorData.init)
     {
-        render!("createuser.dt", _error);
+        auto authInfo = this.authInfo.value;
+        render!("createuser.dt", _error, authInfo);
     }
 
     @auth(Role.admin) @errorDisplay!getCreateuser void postCreateuser(string username,
@@ -120,7 +124,8 @@ private:
         string field;
     }
 
-    SessionVar!(AuthInfo, "authInfo") authInfo;
+    SessionVar!(AuthInfo, "authInfo") authInfo = AuthInfo(BsonObjectID.init,
+            string.init, string.init, Privilege.None);
 
     @Autowire EventStore eventStore;
     @Autowire Authenticator authenticator;

test/calendarwebapp/testauthenticator.d

@@ -46,7 +46,7 @@ public:
 
     auto userBson = Bson(["_id" : Bson(BsonObjectID.fromString("5988ef4ae6c19089a1a53b79")),
             "username" : Bson("foo"), "passwordHash"
-            : Bson("$2a$10$9LBqOZV99ARiE4Nx.2b7GeYfqk2.0A32PWGu2cRGyW2hRJ0xeDfnO"), "role" : Bson(1)]);
+            : Bson("$2a$10$9LBqOZV99ARiE4Nx.2b7GeYfqk2.0A32PWGu2cRGyW2hRJ0xeDfnO"), "privilege" : Bson(1)]);
 
     collection.returnValue!"findOne"(Bson(null), userBson, userBson);
 
@@ -60,7 +60,7 @@ public:
 @safe unittest
 {
     AuthInfo auth;
-    auth.role = Role.User;
+    auth.privilege = Privilege.User;
     auth.isUser.shouldBeTrue;
 }
 
@@ -68,7 +68,7 @@ public:
 @safe unittest
 {
     AuthInfo auth;
-    auth.role = Role.Admin;
+    auth.privilege = Privilege.None;
     auth.isUser.shouldBeFalse;
 }
 
@@ -76,7 +76,7 @@ public:
 @safe unittest
 {
     AuthInfo auth;
-    auth.role = Role.Admin;
+    auth.privilege = Privilege.Admin;
     auth.isAdmin.shouldBeTrue;
 }
 
@@ -84,6 +84,22 @@ public:
 @safe unittest
 {
     AuthInfo auth;
-    auth.role = Role.User;
+    auth.privilege = Privilege.None;
     auth.isAdmin.shouldBeFalse;
 }
+
+@("AuthInfo.isNone success")
+@safe unittest
+{
+    AuthInfo auth;
+    auth.privilege = Privilege.None;
+    auth.isNone.shouldBeTrue;
+}
+
+@("AuthInfo.isNone failure")
+@safe unittest
+{
+    AuthInfo auth;
+    auth.privilege = Privilege.User;
+    auth.isNone.shouldBeFalse;
+}

views/createuser.dt

@@ -29,4 +29,4 @@ block content
 				tfoot
 					tr
 						td(colspan="2")
-							input#submitButton(type="submit", value="Ereignis erstellen")
+							input#submitButton(type="submit", value="Benutzer erstellen")

views/navigation.dt

@@ -1,9 +1,11 @@
+- if(!authInfo.isNone())
 	nav
 		ul
 			li
 				a(href='/') Home
 			li
 				a(href='/createevent') Ereignis erstellen
+			- if(authInfo.isAdmin())
 				li
 					a(href='/users') Benutzerliste
 				li

views/showusers.dt

@@ -10,8 +10,8 @@ block content
 				td username
 				td #{user.username}
 			tr
-				td role
-				td #{user.role}
+				td privilege
+				td #{user.privilege}
 		form(action="/removeuser", method="post")
 			input#id(value="#{user.id}", name="id", type="hidden")
 			input#submitButton(type="submit", value="Entfernen")