api: added get(:show) to identities and users, allow monitors to create/delete test & tmp users.

1 files changed, 6 insertions, 0 deletions

diff --git a/app/controllers/controller_extension/authentication.rb b/app/controllers/controller_extension/authentication.rb
index e2b24f0..63b9e5f 100644
--- a/app/controllers/controller_extension/authentication.rb
+++ b/app/controllers/controller_extension/authentication.rb
@@ -34,6 +34,12 @@ module ControllerExtension::Authentication
     access_denied unless admin?
   end
 
+  def require_monitor
+    unless current_user.is_monitor? || current_user.is_admin?
+      access_denied
+    end
+  end
+
   def authentication_errors
     return unless attempted_login?
     errors = get_warden_errors