First

app/controllers/admins_controller.rb

@@ -0,0 +1,38 @@
+class AdminsController < ApplicationController
+  PASSWORD_PARTS = %w[GEAR AXLE TURBO PARK].freeze
+
+  def show
+    @unlocked = admin_unlocked?
+  end
+
+  def create
+    if submitted_password == admin_password
+      session[:admin_unlocked] = true
+      redirect_to admin_path, notice: "Admin Panel Unlocked"
+    else
+      session[:admin_unlocked] = false
+      @unlocked = false
+      flash.now[:alert] = "That passphrase did not unlock anything. Check the advert again."
+      render :show, status: :unprocessable_entity
+    end
+  end
+
+  def destroy
+    session.delete(:admin_unlocked)
+    redirect_to admin_path, notice: "Admin session cleared."
+  end
+
+  private
+
+  def admin_password
+    PASSWORD_PARTS.join("-")
+  end
+
+  def admin_unlocked?
+    session[:admin_unlocked] == true
+  end
+
+  def submitted_password
+    params.fetch(:password, "").upcase.gsub(/\s+/, "")
+  end
+end