review

app/controllers/application_controller.rb

@@ -2,7 +2,13 @@ class ApplicationController < ActionController::Base
   protect_from_forgery with: :exception
 
   def current_recruiter
-    @current_recruiter ||= User.find_by(id: session[:user]) if session[:user]
+    user_parms = { id: session[:user], role: %w(admin recruiter) }
+    @current_recruiter ||= User.find_by(user_parms) if session[:user]
+  end
+
+  def current_reviewer
+    user_parms = { id: session[:user], role: %w(admin reviewer) }
+    @current_reviewer ||= User.find_by(user_parms) if session[:user]
   end
 
   def current_candidate
@@ -18,4 +24,8 @@ class ApplicationController < ActionController::Base
     def authorize_recruiter
       redirect_to recruiter_login_path unless current_recruiter
     end
+
+    def authorize_reviewer
+      redirect_to review_login_path unless current_reviewer
+    end
 end

app/controllers/recruiter_controller.rb

@@ -26,7 +26,7 @@ class RecruiterController < ApplicationController
   end
 
   def auth
-    recruiter = User.find_by(email: auth_params[:email])
+    recruiter = User.find_by(email: auth_params[:email], role: %w(admin recruiter))
 
     if recruiter && recruiter.authenticate(auth_params[:password])
       session[:user] = recruiter.to_i

app/controllers/review_controller.rb

@@ -0,0 +1,33 @@
+class ReviewController < ApplicationController
+  before_action :authorize_reviewer, except: [:login, :auth]
+
+  def index
+    @candidates = Candidate.where(completed: true).includes(:recruiter)
+  end
+
+  def view
+    @candidate = Candidate.find_by(test_hash: params[:test_hash])
+    @quiz = @candidate.my_quiz
+    @status = QuizStatus.new(@candidate)
+  end
+
+  def login
+    redirect_to review_path unless current_reviewer.nil?
+  end
+
+  def auth
+    reviewer = User.find_by(email: auth_params[:email], role: %w(admin reviewer))
+
+    if reviewer && reviewer.authenticate(auth_params[:password])
+      session[:user] = reviewer.to_i
+      redirect_to review_path
+    else
+      redirect_to review_login_path, flash: { error: "Sorry, incorrect email or password." }
+    end
+  end
+
+  def logout
+    reset_session
+    redirect_to review_login_path
+  end
+end