A page for one role only

Task: show a page to administrators only.

# Recipe: a page only the admins see; everyone else gets 403, and a visitor
# who is not signed in is sent to sign in.
paths:
  components: ./components

require_auth="true" asks for a signed-in session; require_role for one of the listed roles in session.userRole (several are separated by commas, require_role="admin,editor"):

<q:component name="Reports" require_auth="true" require_role="admin">
  <h1>Reports</h1>
  <p>Only admins see this, {session.userName}.</p>
</q:component>

Without a session, the answer redirects to /login (change it with security.login_url):

<q:component name="Login">
  <h1>Sign in</h1>
</q:component>

test:as signs the test's session in with a role, without a password:

<q:test name="an admin sees the page" page="/reports">
  <test:as user="ana" role="admin" />
  <test:visit />
  <test:expect status="200" text="Only admins see this, ana." />
</q:test>

<q:test name="a member is refused with 403" page="/reports">
  <test:as user="bruno" role="member" />
  <test:visit />
  <test:expect status="403" />
</q:test>

<q:test name="a visitor who is not signed in is sent to sign in" page="/reports">
  <test:visit />
  <test:expect status="302" redirect="/login" />
</q:test>

tests/reports.test.q
  PASS  an admin sees the page
  PASS  a member is refused with 403
  PASS  a visitor who is not signed in is sent to sign in
3 passed, 0 failed