user management

app/controllers/application_controller.rb

@@ -2,7 +2,7 @@ class ApplicationController < ActionController::Base
   # Prevent CSRF attacks by raising an exception.
   # For APIs, you may want to use :null_session instead.
   protect_from_forgery with: :exception
-  before_filter :require_login
+  before_action :require_login
   respond_to :html, :json
   helper :access
 

app/controllers/docs_controller.rb

@@ -1,5 +1,5 @@
 class DocsController < ApplicationController
-  skip_before_filter :require_login
+  skip_before_action :require_login
 
   def index
     @doc = {

app/controllers/oauths_controller.rb

@@ -1,5 +1,5 @@
 class OauthsController < ApplicationController
-  skip_before_filter :require_login
+  skip_before_action :require_login
 
   def oauth
     login_at(params[:provider])

app/controllers/staff_controller.rb

@@ -1,6 +0,0 @@
-class StaffController < ApplicationController
-  def index
-    @staff = Person.staff
-    respond_with @staff
-  end
-end

app/controllers/users_controller.rb

@@ -1,6 +1,66 @@
 class UsersController < ApplicationController
   def index
-    @users = Person.admins
-    respond_with @users
+    redirect_to root_path, error: "NOT AUTHORIZED" unless verify_admin! current_user
+
+    @admins = Person.admins
+    @staff = Person.staff
   end
+
+  def new
+    redirect_to root_path, error: "NOT AUTHORIZED" unless verify_admin! current_user
+
+    @user = Person.new
+  end
+
+  def register
+    redirect_to root_path, error: "NOT AUTHORIZED" unless verify_admin! current_user
+
+    @user = Person.create(user_params)
+    if @user
+      redirect_to :root, notice: 'Success! We will authorize you soon.'
+      return
+    else
+      render :new
+    end
+  end
+
+  def edit
+    redirect_to root_path, error: "NOT AUTHORIZED" unless verify_admin! current_user
+
+    @user = Person.find_by_id(params[:id])
+  end
+
+  def show
+    redirect_to root_path, error: "NOT AUTHORIZED" unless verify_admin! current_user
+
+    @user = Person.find_by_id(params[:id])
+  end
+
+  def update
+    redirect_to root_path, error: "NOT AUTHORIZED" unless verify_admin! current_user
+
+    @user = Person.find(params[:id])
+    if @user.update(user_params)
+      redirect_to user_path(@user), notice: 'Updated!'
+    else
+      render :edit
+    end
+  end
+
+  private
+
+    def verify_admin! user
+      user && user.admin?
+    end
+
+    def user_params
+      params.require(:user).permit(
+        :first_name,
+        :last_name,
+        :phone,
+        :email,
+        :admin,
+        :staff
+      )
+    end
 end