fe 2.3.2 → 2.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 63c54a49ce10c97d77e21066af68ae2e4d138f57e1d78789a0b304f2ea26d771
-  data.tar.gz: 860211697773fc5643d50e85617065cd49697725ac2479fb644d321eac620c91
+  metadata.gz: e5901527c0d559c346f9b5260706bae3c5dca50aa53acad6e3389a9953ad3258
+  data.tar.gz: 6ce8e73924606203040a84222cf1ff2127855dff223331b9f83524a91ee8effb
 SHA512:
-  metadata.gz: 20f8c1697604eb9bdf58be607a9c81e86ee4dd0ca9e12e740113c173cbe1402a6371dfa9861ef6861c46b1d9fc6e9ae9f48c069dea829a130ac92d4e32f0e685
-  data.tar.gz: 498cec05620ede4dbee334badd0c2e3810c7d3719816a8a3b7c986238badc9deba878ae0a75ef0a84385330bd17a0a40a2c5cae404e5b32e6a0d688ccaf30591
+  metadata.gz: 2d944254d553ae54b9ac39016114c797a2176fcdedaee5543e50da0fa9dc6162a81087df058f893900194c963c321141c63de5c21d3e25c3c74a103a263a7bc5
+  data.tar.gz: 120a3a78d3a8b443ca1c2cf9f43c36166e0883dfd8d075cc61655637053d02b4600100c9bcdce96a6102fe5fa40ca0e4c7ca150c13ba342234027aa10fe77c70

data/README.md

@@ -58,8 +58,152 @@ Run a specific spec:
 
     bundle exec rails server
 
-### Changelog
-
-#### 2.2
+## Access control
+
+fe denies access by default. It never decides who a person is or what they may
+see. The host app answers two questions, and until it does, fe refuses every
+request. fe also checks at boot: the app raises `Fe::MissingAccessHook` and
+won't start until both hooks exist.
+
+### Required hooks
+
+Define both on `ApplicationController`, or on the fe controllers themselves.
+Private, protected and public methods all count, and so do methods added by a
+module you include or prepend in `config.to_prepare`.
+
+    class ApplicationController < ActionController::Base
+      private
+
+      # May the current person use this answer sheet?
+      # access is :look (viewing it) or :change (anything else).
+      def fe_can_use_answer_sheet?(answer_sheet, access)
+        if answer_sheet.is_a?(Fe::ReferenceSheet)
+          # Reference writers open their sheet from a link that carries its key.
+          Fe.access_key_matches?(answer_sheet, params[:a])
+        else
+          current_user.present? && answer_sheet.owner == current_user
+        end
+      end
+
+      # May the current person use fe's admin screens (the form builder)?
+      def fe_admin?
+        current_user&.admin?
+      end
+    end
+
+`fe_can_use_answer_sheet?(answer_sheet, access)`
+
+- `:look` is used by the `show` actions. `:change` covers every other action
+  that works on an answer sheet (saving answers, submitting, and so on).
+- It judges whatever is in `@answer_sheet` when the check runs. If nothing has
+  loaded the sheet yet, fe calls `get_answer_sheet` first (yours, if you
+  override it), so moving, re-declaring or skipping that callback doesn't skip
+  the check. To change how the sheet loads, override `get_answer_sheet`. If the
+  loader renders or redirects, that is the response. If there is still no
+  sheet (for example a reference link with a wrong key), fe leaves the
+  response to the action.
+- Reference sheets reach the same hook as `Fe::ReferenceSheet` records. A hook
+  that only checks the signed-in user locks reference writers out, so give
+  them their own branch, as in the example. The reference's access key is in
+  `params[:a]`, and `Fe.access_key_matches?(answer_sheet, params[:a])` is the
+  safe way to check it. Whether a key alone is enough is up to your app.
+
+`fe_admin?` takes no arguments. It guards the admin controllers
+(`Fe::Admin::QuestionSheetsController`, `QuestionPagesController`,
+`ElementsController`, `EmailTemplatesController`) and the `index` and `create`
+actions of `Fe::AnswerSheetsController`. The `index` and `create` rule follows
+fe's own code for those actions, so it also covers any controller of yours that
+inherits them without defining its own. If you define `index` or `create`
+yourself (in a subclass, a reopened class or a prepended module), even one that
+only calls `super`, fe's admin check skips it and your action owns its check.
+
+The boot check needs `fe_can_use_answer_sheet?` on every class in
+`Fe::ANSWER_SHEET_CONTROLLERS` and `fe_admin?` on every class in
+`Fe::ADMIN_CONTROLLERS` plus `Fe::AnswerSheetsController`. Defining both on
+`ApplicationController` covers all of them.
+
+### Changing fe's controllers
+
+Reopening an fe controller (with `class_eval`, or a module you include or
+prepend) keeps fe's checks. Replacing one with your own class of the same name
+doesn't: your class gets only the checks it includes or inherits. The checks
+for answer sheets, answer pages and question sheets live in fe concerns
+(`Fe::AnswerSheetsControllerConcern`, `Fe::AnswerPagesControllerConcern`,
+`Fe::Admin::QuestionSheetsControllerConcern`), so a replacement that includes
+the concern keeps them. fe's other controllers declare their checks in the
+class itself, so a replacement for one of them loses those checks unless you
+add them. The boot check only looks for the hook methods, so it can't tell.
+
+### Optional: `fe_access_denied(kind)`
+
+When a check fails, fe sends `403 Forbidden`. To do something else, define
+`fe_access_denied(kind)`. `kind` is `:answer_sheet` or `:admin`.
+
+    def fe_access_denied(kind)
+      redirect_to root_path, alert: 'You do not have access to that.'
+    end
+
+If it renders or redirects, that replaces the 403. If it does neither, fe still
+sends 403. Exceptions raised in your hooks are not rescued.
+
+### Other settings
+
+- `Fe.answer_sheet_types`: the answer sheet classes fe accepts in the
+  `answer_sheet_type` param. Any other class is refused as not found. It
+  defaults to `nil`, which means `Fe.answer_sheet_class` plus
+  `Fe::ReferenceSheet`. Setting it replaces that default, so list every class
+  your app uses, including your `Fe.answer_sheet_class` and
+  `Fe::ReferenceSheet`. Because the default is `nil`, `+=` raises on it. Set it
+  where you set `Fe.answer_sheet_class` (for example in a `config.to_prepare`
+  block, if that's where your app sets the class):
+
+      Fe.answer_sheet_class = 'Fe::Application'
+      Fe.answer_sheet_types = %w[Fe::Application Fe::ReferenceSheet MyOtherSheet]
+
+- `Fe.element_types`: the element classes the form builder accepts in the
+  `element_type` param. It defaults to fe's own element classes, so add yours
+  to it:
+
+      Fe.element_types += %w[MyRatingField]
+
+- `Fe.access_key_matches?(answer_sheet, key)`: constant-time comparison of a
+  key against the sheet's `access_key`. False for a blank or non-string key,
+  and false when the sheet's own `access_key` is blank.
+- `Fe.verify_access_hooks_on_boot` (default `true`): set to `false` to turn off
+  the boot check. It is meant only for fe's own test app. Leave it on in a real
+  app.
+
+### Upgrading to 2.4
+
+- fe no longer calls `check_valid_user`. Move that logic into
+  `fe_can_use_answer_sheet?` and `fe_admin?`.
+- fe accepts only the classes in `Fe.answer_sheet_types` in the
+  `answer_sheet_type` param, and by default that is just
+  `Fe.answer_sheet_class` and `Fe::ReferenceSheet`. Every other sheet class is
+  refused as not found. fe's pages send the sheet's class in that param on
+  every page load and save, so if your app has any other answer sheet classes,
+  set `Fe.answer_sheet_types` to list all of them (see above).
+- The form builder accepts only the element classes in `Fe.element_types`. Add
+  any element classes of your own.
+- `index` and `create` on `Fe::AnswerSheetsController` are admin-only
+  (`fe_admin?`), and so are those actions in any controller of yours that
+  inherits them without defining its own.
+- `Fe::ReferenceSheetsController` allows only `edit`, `show` and `done`. Other
+  actions return 404. `show` is checked with `:look`, and a `show` link with a
+  wrong or missing key now gets the not-found page with a 404 instead of an
+  error.
+- If your app overrides `fe/questions/fe/_attachment_field.html.erb`, add
+  `a: params[:a]` to its upload, delete and page reload URLs, as fe's own
+  partial now does. Without the key, reference writers get 403 when they
+  attach a file.
+- Define both hooks before deploying, or the app won't boot.
+
+## Changelog
+
+### 2.4
+
+- **Deny by default**: fe refuses answer sheets and its admin screens unless the host app allows them, and the app won't boot until it defines fe's access hooks. See [Upgrading to 2.4](#upgrading-to-24).
+
+### 2.2
 
 - **Accidental overwrite protection**: When multiple tabs/windows have the same form open, autosave could silently overwrite another tab's answers. Now an MD5 digest of the current answers is tracked, and saves are rejected if the answers have changed since the page was loaded.

data/app/controllers/concerns/fe/access_control_concern.rb

@@ -0,0 +1,39 @@
+module Fe::AccessControlConcern
+  extend ActiveSupport::Concern
+
+  private
+
+  # Must not rely on get_answer_sheet having run first: re-declaring a callback
+  # moves it to the end of the chain. A request that still has no sheet after
+  # loading is left to the action.
+  def fe_authorize_answer_sheet!
+    return if performed?
+    get_answer_sheet if @answer_sheet.nil? && respond_to?(:get_answer_sheet, true)
+    return if performed? || @answer_sheet.nil?
+
+    access = action_name == 'show' ? :look : :change
+    allowed = respond_to?(:fe_can_use_answer_sheet?, true) && fe_can_use_answer_sheet?(@answer_sheet, access)
+    fe_deny!(:answer_sheet) unless allowed
+  end
+
+  def fe_require_admin!
+    return if performed?
+
+    allowed = respond_to?(:fe_admin?, true) && fe_admin?
+    fe_deny!(:admin) unless allowed
+  end
+
+  # A subclass, reopened class or prepended module that defines the action
+  # replaces fe's and owns its access control, so it must not be gated here.
+  def fe_require_admin_for_own_action!
+    return unless self.class.instance_method(action_name).owner == Fe::AnswerSheetsControllerConcern
+
+    fe_require_admin!
+  end
+
+  # Whatever the host's fe_access_denied does, the request must not continue.
+  def fe_deny!(kind)
+    fe_access_denied(kind) if respond_to?(:fe_access_denied, true)
+    head :forbidden unless performed?
+  end
+end

data/app/controllers/concerns/fe/admin/question_sheets_controller_concern.rb

@@ -3,7 +3,8 @@ module Fe::Admin::QuestionSheetsControllerConcern
 
   begin
     included do
-      before_action :check_valid_user
+      include Fe::AccessControlConcern
+      before_action :fe_require_admin!
       before_action :get_question_sheet, only: [:show, :archive, :unarchive, :destroy, :edit, :update, :duplicate]
       layout 'fe/fe_admin'
     end

data/app/controllers/concerns/fe/answer_pages_controller_concern.rb

@@ -1,9 +1,11 @@
 module Fe::AnswerPagesControllerConcern
   extend ActiveSupport::Concern
+  include Fe::AccessControlConcern
 
   begin
     included do
       before_action :get_answer_sheet, only: [:show, :edit, :update, :save_file, :delete_file]
+      before_action :fe_authorize_answer_sheet!, only: [:show, :edit, :update, :save_file, :delete_file]
       before_action :set_quiet_reference_email_change, only: :update
       skip_before_action :verify_authenticity_token, only: :save_file
     end
@@ -165,7 +167,7 @@ module Fe::AnswerPagesControllerConcern
   end
 
   def answer_sheet_type
-    (params[:answer_sheet_type] || Fe.answer_sheet_class || 'AnswerSheet').constantize
+    Fe.answer_sheet_class_for(params[:answer_sheet_type])
   end
 
   def answer_params

data/app/controllers/concerns/fe/answer_sheets_controller_concern.rb

@@ -1,10 +1,13 @@
 module Fe::AnswerSheetsControllerConcern
   extend ActiveSupport::Concern
+  include Fe::AccessControlConcern
 
   begin
     included do
       layout 'fe/application'
+      before_action :fe_require_admin_for_own_action!, only: [:index, :create]
       before_action :get_answer_sheet, only: [:edit, :show, :send_reference_invite, :submit]
+      before_action :fe_authorize_answer_sheet!, only: [:edit, :show, :send_reference_invite, :submit]
       after_action :inject_answers_digest_script, only: :edit
     end
   rescue ActiveSupport::Concern::MultipleIncludedBlocks
@@ -94,7 +97,7 @@ module Fe::AnswerSheetsControllerConcern
 
   def answer_sheet_type
     return Fe::ReferenceSheet if params[:controller] == "fe/reference_sheets"
-    (params[:answer_sheet_type] || Fe.answer_sheet_class || 'AnswerSheet').constantize
+    Fe.answer_sheet_class_for(params[:answer_sheet_type])
   end
 
   def get_answer_sheet

data/app/controllers/fe/admin/elements_controller.rb

@@ -1,5 +1,6 @@
 class Fe::Admin::ElementsController < ApplicationController
-  before_action :check_valid_user
+  include Fe::AccessControlConcern
+  before_action :fe_require_admin!
 
   before_action :get_page
 
@@ -19,7 +20,7 @@ class Fe::Admin::ElementsController < ApplicationController
   end
 
   def new
-    @questions = params[:element_type].constantize.active.shared.order('label')
+    @questions = Fe.element_class_for(params[:element_type]).active.shared.order('label')
 
     @style = element_params[:style]
     if @style
@@ -48,7 +49,7 @@ class Fe::Admin::ElementsController < ApplicationController
 
   # POST /elements
   def create
-    @element = params[:element_type].constantize.new(element_params)
+    @element = Fe.element_class_for(params[:element_type]).new(element_params)
     @element.required = true if @element.question?
     @question_sheet = @page.question_sheet
 

data/app/controllers/fe/admin/email_templates_controller.rb

@@ -1,5 +1,6 @@
 class Fe::Admin::EmailTemplatesController < ApplicationController
-  before_action :check_valid_user
+  include Fe::AccessControlConcern
+  before_action :fe_require_admin!
   layout 'fe/fe_admin'
 
   def index 

data/app/controllers/fe/admin/question_pages_controller.rb

@@ -1,5 +1,6 @@
 class Fe::Admin::QuestionPagesController < ApplicationController
-  before_action :check_valid_user
+  include Fe::AccessControlConcern
+  before_action :fe_require_admin!
 
   before_action :get_sheet
 

data/app/controllers/fe/reference_pages_controller.rb

@@ -1,12 +1,15 @@
 # gather reference information from Applicant
 module Fe
   class ReferencePagesController < ApplicationController
+    include Fe::AccessControlConcern
+
     skip_before_action :cas_filter, raise: false
     skip_before_action :authentication_filter, raise: false
 
     layout nil
 
     before_action :setup
+    before_action :fe_authorize_answer_sheet!
 
     MONTHS_KNOWN_OPTIONS = [
       ["3 months", 3],
@@ -35,6 +38,7 @@ module Fe
     private
     def setup
       @application = Application.find(params[:application_id])
+      @answer_sheet ||= @application
     end
 
   end

data/app/controllers/fe/reference_sheets_controller.rb

@@ -1,7 +1,8 @@
 # TODO determine how this relates to Fe::ReferencesController and if we can delete one of the two
 class Fe::ReferenceSheetsController < Fe::AnswerSheetsController
   skip_before_action :ssm_login_required, :login, raise: false
-  before_action :edit_only, except: [:edit]
+  # Prepended so other actions stop before a sheet loads or the host's hook runs.
+  prepend_before_action :edit_only, except: [:edit, :show, :done]
 
   def edit
     @reference_sheet = @answer_sheet
@@ -19,6 +20,11 @@ class Fe::ReferenceSheetsController < Fe::AnswerSheetsController
     render 'fe/answer_sheets/edit', layout: 'fe/application'
   end
 
+  def show
+    return render(:not_found, status: :not_found) unless @answer_sheet
+    super
+  end
+
   protected
     def get_answer_sheet
       @answer_sheet ||= Fe::ReferenceSheet.find_by_id_and_access_key(params[:id], params[:a])
@@ -26,6 +32,6 @@ class Fe::ReferenceSheetsController < Fe::AnswerSheetsController
     end
 
     def edit_only
-      return false
+      head :not_found
     end
 end

data/app/controllers/fe/references_controller.rb

@@ -2,10 +2,13 @@
 # TODO determine how this relates to Fe::ReferenceSheetsController and if we can delete one of the two
 module Fe
   class ReferencesController < ApplicationController
+    include Fe::AccessControlConcern
+
     skip_before_action :cas_filter, raise: false
     skip_before_action :authentication_filter, raise: false
 
     before_action :setup
+    before_action :fe_authorize_answer_sheet!
 
     layout 'public'
 
@@ -70,6 +73,7 @@ module Fe
     private
     def setup
       @application = Application.find(params[:application_id])
+      @answer_sheet ||= @application
     end
   end
 end

data/app/controllers/fe/submit_pages_controller.rb

@@ -1,6 +1,8 @@
 class Fe::SubmitPagesController < ApplicationController
+  include Fe::AccessControlConcern
 
   before_action :setup
+  before_action :fe_authorize_answer_sheet!
   skip_before_action :get_answer_sheet, raise: false
 
   layout nil

data/app/views/fe/answer_pages/update.js.erb

@@ -8,7 +8,8 @@
     $('#<%= dom_id(@answer.question) %>_filename').html('Current File: ' +
         '<%= link_to(@answer.attachment_file_name, @answer.attachment.expiring_url) %>' +
         '<%= link_to(image_tag("fe/icons/minus-button.png"),
-                     delete_file_fe_answer_sheet_page_path(@presenter.active_answer_sheet, @page, question_id: @answer.question.id),
+                     delete_file_fe_answer_sheet_page_path(@presenter.active_answer_sheet, @page, question_id: @answer.question.id,
+                                                           answer_sheet_type: @answer_sheet.class.name, a: params[:a]),
                      method: :delete, remote: true) %>')
     $('#<%= dom_id(@answer.question) %>_filename').effect('highlight')
 <% elsif @answer %>

data/app/views/fe/questions/fe/_attachment_field.html.erb

@@ -6,7 +6,7 @@
     <% if answer %>
       Current File: <%= link_to(answer.attachment.filename, url_for(answer.attachment)) %>
       <%= link_to(image_tag("fe/icons/minus-button.png"),
-                  delete_file_fe_answer_sheet_page_path(@presenter.active_answer_sheet, @page, question_id: element_id, answer_sheet_type: @answer_sheet.class.name),
+                  delete_file_fe_answer_sheet_page_path(@presenter.active_answer_sheet, @page, question_id: element_id, answer_sheet_type: @answer_sheet.class.name, a: params[:a]),
                   method: :delete, remote: true) %>
     <% end %>
   <% else %>
@@ -19,7 +19,7 @@
              if answer&.attachment&.attached? %>
             Current File: <%= link_to(answer.attachment.filename, url_for(answer.attachment)) %>
             <%= link_to(image_tag('fe/icons/minus-button.png'),
-                        delete_file_fe_answer_sheet_page_path(@presenter.active_answer_sheet, @page, question_id: element_id, answer_sheet_type: @answer_sheet.class.name),
+                        delete_file_fe_answer_sheet_page_path(@presenter.active_answer_sheet, @page, question_id: element_id, answer_sheet_type: @answer_sheet.class.name, a: params[:a]),
                         method: :delete, remote: true) %>
           <% end %>
         </span>
@@ -29,7 +29,7 @@
         <% session_key_name = Rails.application.config.session_options[:key] %>
         $('#<%= dom_id(attachment_field) %>_file_uploader').uploadify({
             uploader        : '<%= asset_path "fe/uploadify/uploadify.swf" %>',
-            script          : '<%= save_file_fe_answer_sheet_page_path(@presenter.active_answer_sheet, @page, question_id: element_id, answer_sheet_type: @answer_sheet.class.name).html_safe %>',
+            script          : '<%= save_file_fe_answer_sheet_page_path(@presenter.active_answer_sheet, @page, question_id: element_id, answer_sheet_type: @answer_sheet.class.name, a: params[:a]).html_safe %>',
             fileDesc        : 'Pick a file',
             fileExt         : '<%= attachment_field.content || "*.*" %>',
             auto            : true,
@@ -58,15 +58,15 @@
       <% if answer&.attachment&.attached? %>
         Current File: <%= link_to(answer.attachment.filename, url_for(answer.attachment)) %>
         <%= link_to(image_tag("fe/icons/minus-button.png"),
-                    delete_file_fe_answer_sheet_page_path(@presenter.active_answer_sheet, @page, question_id: element_id, answer_sheet_type: @answer_sheet.class.name),
+                    delete_file_fe_answer_sheet_page_path(@presenter.active_answer_sheet, @page, question_id: element_id, answer_sheet_type: @answer_sheet.class.name, a: params[:a]),
                     method: :delete, remote: true, class: 'remove_current') %>
         <script>
           $('<%= base_element %> .remove_current').click(function() {
             $.ajax({
               type: 'DELETE',
-              url: '<%= delete_file_fe_answer_sheet_page_path(@presenter.active_answer_sheet, @page, question_id: element_id, answer_sheet_type: @answer_sheet.class.name).html_safe %>',
+              url: '<%= delete_file_fe_answer_sheet_page_path(@presenter.active_answer_sheet, @page, question_id: element_id, answer_sheet_type: @answer_sheet.class.name, a: params[:a]).html_safe %>',
               success: function(result) {
-                $.get("/fe/answer_sheets/<%= @answer_sheet.id %>/page/<%= @page.id %>/edit?answer_sheet_type=<%= @answer_sheet.class.name %>", function(data) {
+                $.get("<%= edit_fe_answer_sheet_page_path(@answer_sheet, @page, answer_sheet_type: @answer_sheet.class.name, a: params[:a]).html_safe %>", function(data) {
                   $('<%= base_element %>').replaceWith($(data).find('<%= base_element %>'))
                 });
               }
@@ -98,7 +98,7 @@
 
               let $input = $("<%= base_element %> .upload_field").html5_upload({
                   url: function(number) {
-                    return "<%= save_file_fe_answer_sheet_page_path(@presenter.active_answer_sheet, @page, question_id: element_id, answer_sheet_type: @answer_sheet.class.name).html_safe %>";
+                    return "<%= save_file_fe_answer_sheet_page_path(@presenter.active_answer_sheet, @page, question_id: element_id, answer_sheet_type: @answer_sheet.class.name, a: params[:a]).html_safe %>";
                   },
                   sendBoundary: window.FormData || $.browser.mozilla,
                   onStart: function(event, total) {
@@ -123,7 +123,7 @@
                     // Re-render the attachment file to show the current file; use the page view, which is not the
                     // most efficient way, but lets us avoid making an action just for this.  And the amount of data
                     // on a page is not that much
-                    $.get("/fe/answer_sheets/<%= @answer_sheet.id %>/page/<%= @page.id %>/edit?answer_sheet_type=<%= @answer_sheet.class.name %>", function(data) {
+                    $.get("<%= edit_fe_answer_sheet_page_path(@answer_sheet, @page, answer_sheet_type: @answer_sheet.class.name, a: params[:a]).html_safe %>", function(data) {
                       $('<%= base_element %>').replaceWith($(data).find('<%= base_element %>'))
                     });
                   },

data/lib/fe/access_control.rb

@@ -0,0 +1,72 @@
+module Fe
+  # Class names accepted from request params for answer sheets. Defaults to
+  # the answer sheet class plus Fe::ReferenceSheet.
+  mattr_accessor :answer_sheet_types
+  self.answer_sheet_types = nil
+
+  mattr_accessor :element_types
+  self.element_types = %w[
+    Fe::Section Fe::Paragraph Fe::TextField Fe::ChoiceField Fe::DateField
+    Fe::QuestionGrid Fe::QuestionGridWithTotal Fe::AttachmentField
+    Fe::ReferenceQuestion Fe::StateChooser
+  ]
+
+  def self.allowed_answer_sheet_types
+    answer_sheet_types || [answer_sheet_class, 'Fe::ReferenceSheet']
+  end
+
+  def self.answer_sheet_class_for(name)
+    return answer_sheet_class.constantize if name.blank?
+    raise ActiveRecord::RecordNotFound unless allowed_answer_sheet_types.include?(name)
+    name.constantize
+  end
+
+  def self.element_class_for(name)
+    raise ActiveRecord::RecordNotFound unless element_types.include?(name)
+    name.constantize
+  end
+
+  def self.access_key_matches?(answer_sheet, key)
+    return false unless key.is_a?(String) && !key.empty?
+    expected = answer_sheet.access_key
+    return false if expected.blank?
+    ActiveSupport::SecurityUtils.secure_compare(expected, key)
+  end
+
+  class MissingAccessHook < StandardError; end
+
+  ANSWER_SHEET_CONTROLLERS = %w[
+    Fe::AnswerSheetsController Fe::AnswerPagesController Fe::ReferenceSheetsController
+    Fe::SubmitPagesController Fe::ReferencePagesController Fe::ReferencesController
+  ].freeze
+
+  ADMIN_CONTROLLERS = %w[
+    Fe::Admin::QuestionSheetsController Fe::Admin::QuestionPagesController
+    Fe::Admin::ElementsController Fe::Admin::EmailTemplatesController
+  ].freeze
+
+  mattr_accessor :verify_access_hooks_on_boot
+  self.verify_access_hooks_on_boot = true
+
+  # Raises Fe::MissingAccessHook unless the host app defines the access hooks
+  # on every fe controller that calls them. Fe::AnswerSheetsController also
+  # calls fe_admin? (index and create), and Fe::ReferenceSheetsController
+  # inherits it. fe must never define either hook itself, or this check could
+  # not detect a missing host implementation.
+  def self.verify_access_hooks!
+    missing = {
+      fe_can_use_answer_sheet?: ANSWER_SHEET_CONTROLLERS,
+      fe_admin?: ADMIN_CONTROLLERS + %w[Fe::AnswerSheetsController]
+    }.flat_map do |hook, names|
+      names.map(&:constantize).reject { |klass|
+        klass.method_defined?(hook) || klass.private_method_defined?(hook)
+      }.map { |klass| [hook, klass.name] }
+    end
+    return if missing.empty?
+
+    lines = missing.map { |hook, name| "  #{name} needs ##{hook}" }
+    raise MissingAccessHook,
+      "The host app must define fe's access hooks, and these are missing:\n#{lines.join("\n")}\n" \
+      'See the "Access control" section of the fe README.'
+  end
+end

data/lib/fe/engine.rb

@@ -58,6 +58,10 @@ module Fe
       end
     end
 
+    config.after_initialize do
+      Fe.verify_access_hooks! if Fe.verify_access_hooks_on_boot
+    end
+
     config.generators do |g|
       g.test_framework      :rspec,        fixture: false
       g.fixture_replacement :factory_bot, dir: 'spec/factories'

data/lib/fe/version.rb

@@ -1,3 +1,3 @@
 module Fe
-  VERSION = "2.3.2"
+  VERSION = "2.4.0"
 end

data/lib/fe.rb

@@ -1,4 +1,5 @@
 require "fe/engine"
+require "fe/access_control"
 
 module Fe
   LANGUAGES = { 'es' => 'Español', 'pt' => 'Português' }

data/spec/controllers/fe/admin/elements_controller_spec.rb

@@ -1,6 +1,24 @@
 require 'rails_helper'
 
 describe Fe::Admin::ElementsController, type: :controller do
+  context 'element_type param' do
+    let(:page) { create(:page) }
+    let(:question_sheet) { page.question_sheet }
+
+    it 'rejects a disallowed type on #new' do
+      expect {
+        get :new, params: {element_type: 'Fe::Application', question_sheet_id: question_sheet.id, page_id: page.id}, xhr: true
+      }.to raise_error(ActiveRecord::RecordNotFound)
+    end
+
+    it 'rejects a disallowed type on #create without creating anything' do
+      expect {
+        expect {
+          post :create, params: {element_type: 'Fe::Application', element: { style: 'style' }, question_sheet_id: question_sheet.id, page_id: page.id}, xhr: true
+        }.to raise_error(ActiveRecord::RecordNotFound)
+      }.not_to change { Fe::Element.count }
+    end
+  end
   context '#show' do
     it 'should work' do
       answer_sheet = create(:answer_sheet)
@@ -212,3 +230,14 @@ describe Fe::Admin::ElementsController, type: :controller do
     end
   end
 end
+
+describe Fe::Admin::ElementsController, type: :controller do
+  it 'returns 403 on #create and creates nothing when the host says the person is not an admin' do
+    allow(controller).to receive(:fe_admin?).and_return(false)
+    page = create(:page)
+    expect {
+      post :create, params: {element_type: 'Fe::TextField', element: { style: 'style' }, question_sheet_id: page.question_sheet.id, page_id: page.id}, xhr: true
+    }.not_to change { Fe::Element.count }
+    expect(response).to have_http_status(:forbidden)
+  end
+end

data/spec/controllers/fe/admin/email_templates_controller_spec.rb

@@ -27,3 +27,11 @@ describe Fe::Admin::EmailTemplatesController, type: :controller do
     end
   end
 end
+
+describe Fe::Admin::EmailTemplatesController, type: :controller do
+  it 'returns 403 on #index when the host says the person is not an admin' do
+    allow(controller).to receive(:fe_admin?).and_return(false)
+    get :index
+    expect(response).to have_http_status(:forbidden)
+  end
+end

data/spec/controllers/fe/admin/question_pages_controller_spec.rb

@@ -9,3 +9,12 @@ describe Fe::Admin::QuestionPagesController, type: :controller do
     end
   end
 end
+
+describe Fe::Admin::QuestionPagesController, type: :controller do
+  it 'returns 403 on #show when the host says the person is not an admin' do
+    allow(controller).to receive(:fe_admin?).and_return(false)
+    page = create(:page)
+    get :show, params: {question_sheet_id: page.question_sheet.id, id: page.id}, xhr: true
+    expect(response).to have_http_status(:forbidden)
+  end
+end