From af2d323ff138f794e45b0337f8a6bde8fdc9a4b8 Mon Sep 17 00:00:00 2001
From: David Gwilliam <dhgwilliam@gmail.com>
Date: Fri, 27 Mar 2026 13:09:51 -0700
Subject: [PATCH] feat: Add authentication helpers to base action

---
 app/action.rb | 52 ++++++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 51 insertions(+), 1 deletion(-)

diff --git a/app/action.rb b/app/action.rb
index 9872821..1a356fe 100644
--- a/app/action.rb
+++ b/app/action.rb
@@ -5,7 +5,11 @@ require "hanami/action"
 
 module EuchreCamp
   class Action < Hanami::Action
-    include Deps[users_repo: 'repositories.users', players_repo: 'repositories.players']
+    include Deps[
+      users_repo: 'repositories.users',
+      players_repo: 'repositories.players',
+      matches_repo: 'repositories.matches'
+    ]
 
     protected
 
@@ -38,10 +42,56 @@ module EuchreCamp
       end
     end
 
+    # Require specific role
+    def require_role(request, response, *allowed_roles)
+      user = current_user(request)
+      return false unless user
+
+      unless allowed_roles.include?(user.role.to_sym)
+        response.flash[:error] = 'Access denied'
+        response.redirect_to '/rankings'
+        return false
+      end
+
+      true
+    end
+
+    # Check authorization for an action
+    def authorize(request, response, action, resource = nil, context = {})
+      user = current_user(request)
+      return false unless user
+
+      unless EuchreCamp::Services::Authorization.can?(user, action, resource, context)
+        response.flash[:error] = 'You do not have permission to perform this action'
+        response.redirect_to '/rankings'
+        return false
+      end
+
+      true
+    end
+
     # Helper to pass current_player to view
     def render_with_player(request, response, **options)
       player = current_player(request)
       response.render(view, current_player: player, **options)
     end
+
+    # Get match and check if user can edit it
+    def get_editable_match(request, response, match_id)
+      match = matches_repo.by_id(match_id)
+      return nil unless match
+
+      user = current_user(request)
+      return match unless user
+
+      # Check if match is within 5 minutes for regular users
+      if EuchreCamp::Services::Authorization.can?(user, :edit_own_match_within_5_min, match)
+        match
+      else
+        response.flash[:error] = 'Match cannot be edited (too old or not your match)'
+        response.redirect_to '/admin/matches'
+        nil
+      end
+    end
   end
 end