Only admins can edit entropy

app/controllers/account/entropies_controller.rb

@@ -1,4 +1,6 @@
 class Account::EntropiesController < ApplicationController
+  before_action :ensure_admin
+
   def update
     Account.sole.entropy.update!(entropy_params)
     redirect_to account_settings_path, notice: "Account updated"

test/controllers/accounts/entropies_controller_test.rb

@@ -12,4 +12,11 @@ class Account::EntropiesControllerTest < ActionDispatch::IntegrationTest
 
     assert_redirected_to account_settings_path
   end
+
+  test "update requires admin" do
+    logout_and_sign_in_as :david
+
+    put account_entropy_path, params: { entropy: { auto_postpone_period: 1.day } }
+    assert_response :forbidden
+  end
 end