The authentication system needs to be reworked. Having auto-admin do the authorization at all is bad. Having auto-admin keep a user object in the session is double-bad (breaks app if user model is updated and sessions aren't cleared).
The model that Comatose uses is pretty clean. Have an overridable 'authorize' method that can be set in environment.rb. Let the user handle their own authorization (bounce to their login page, etc).
Here's an example comatose setup in environment.rb:
class ComatoseAdminController
# Overidde the authorize check... It runs as a before_filter
# use the standard STIRR auth check
def authorize
load_user
return false unless authenticated?
unless (@current_user.admin? || @current_user.manager?)
return false
end
true
end
# return the loaded user name (assumes we've been authenticated already)
def get_author
return @current_user.first_name + " " + @current_user.last_name if @current_user
"[unknown]"
end
end
Comatose::Options.admin_title = "The amazing auto-admin"
Comatose::Options.admin_sub_title = "density is good"
Comatose::Options.default_tree_level = 3
Comatose::Options.default_filter = 'Textile'
#Comatose::Options.default_processor = :liquid
Comatose::Options.default_processor = :erb
