Extract authorization policy for viewing statuses (#3150)

2017-05-29 09:22:22 -07:00
parent 9a81be0d37
commit 3a2003ba86
16 changed files with 155 additions and 80 deletions
--- a/app/controllers/api/activitypub/notes_controller.rb
+++ b/app/controllers/api/activitypub/notes_controller.rb
@ -1,12 +1,14 @@
 # frozen_string_literal: true

 class Api::Activitypub::NotesController < ApiController
+  include Authorization
+
  before_action :set_status

  respond_to :activitystreams2

  def show
-    forbidden unless @status.permitted?
+    authorize @status, :show?
  end

  private