Add access control and :forbidden error handling

app/controllers/application_controller.rb

@@ -1,6 +1,15 @@
 class ApplicationController < ActionController::Base
+  helper_method :current_user_at_least
+
   before_action :authenticate_user!
 
+  class AccessForbidden < StandardError
+  end
+
+  def current_user_at_least(status)
+    User.statuses[current_user.status] >= User.statuses[status]
+  end
+
   protected
 
   def after_sign_out_path_for(scope)

app/controllers/users_controller.rb

@@ -1,7 +1,9 @@
 class UsersController < ApplicationController
-  before_action :set_user, only: %i[ show edit update destroy ]
+  before_action :find_user, only: [:show, :edit, :update, :destroy]
+  before_action do
+    raise AccessForbidden unless (current_user == @user) || current_user_at_least(:admin)
+  end
 
-  # GET /users
   def index
     @users = User.all
   end
@@ -47,7 +49,7 @@ class UsersController < ApplicationController
 
   private
     # Use callbacks to share common setup or constraints between actions.
-    def set_user
+    def find_user
       @user = User.find(params[:id])
     end