class ApplicationController < ActionController::Base
  # Prevent CSRF attacks by raising an exception.
  # For APIs, you may want to use :null_session instead.
  protect_from_forgery with: :exception

  protected

  def authenticate_user!(options = {})
    if user_signed_in?
      super
    else
      redirect_to '/users/sign_in'
    end
  end

  alias_method :devise_current_user, :current_user

  def current_user
    UserPresenter.new(devise_current_user || User.null)
  end

end

class ApplicationController < ActionController::Base
  # Prevent CSRF attacks by raising an exception.
  # For APIs, you may want to use :null_session instead.
  protect_from_forgery with: :exception

  # Send 'em back where they came from with a slap on the wrist
  def authority_forbidden(error)
    Authority.logger.warn(error.message)
    flash[:alert] = 'You are not authorized to complete that action.'
    redirect_to request.referrer.presence || root_path
  end

  protected

  def authenticate_user!(options = {})
    if user_signed_in?
      super
    else
      redirect_to '/users/sign_in'
    end
  end

  alias_method :devise_current_user, :current_user

  def current_user
    UserPresenter.new(devise_current_user || User.null)
  end

end

Handle unauthorized actions with a flash
Handle unauthorized actions with a flash

Why:

Instead of displaying a jarring 'Unauthorized' error, we want to direct
people back to the page they were on, with a flash.

NOTE: We'll want to come back and test this.

NOTE: We also need to decide how to handle unauthorized errors in the
API.

This change addresses the need by:

* Adding the flash-based authorizer to the ApplicationController.
