diff options
author | Kazuki Yamaguchi <k@rhe.jp> | 2015-08-08 01:51:22 +0900 |
---|---|---|
committer | Kazuki Yamaguchi <k@rhe.jp> | 2015-08-08 01:53:42 +0900 |
commit | 0414e78726b26aa224a3d746cc5792dbd19255a9 (patch) | |
tree | 7c7633b1ddf206a0e6e493fce60e388f1f3e14e1 /app/controllers/application_controller.rb | |
parent | 7cf21dd7e4eadec8a40bf09248835413eb3cc8d5 (diff) | |
download | aclog-0414e78726b26aa224a3d746cc5792dbd19255a9.tar.gz |
web: refactor permission check
Diffstat (limited to 'app/controllers/application_controller.rb')
-rw-r--r-- | app/controllers/application_controller.rb | 27 |
1 files changed, 13 insertions, 14 deletions
diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index fe1f1a9..9cc2785 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -6,7 +6,7 @@ class ApplicationController < ActionController::Base protect_from_forgery with: :exception helper_method :logged_in?, :current_user - helper_method :authorized_to_show_user? + helper_method :authorized? def routing_error raise ActionController::RoutingError, "No route matches #{params[:unmatched_route]}" @@ -24,24 +24,23 @@ class ApplicationController < ActionController::Base end end - def authorized_to_show_user?(user) - !user.protected? || - (logged_in? && current_user.permitted_to_see?(user)) - end - - def authorize!(object) + def authorized?(object) case object when User - unless authorized_to_show_user?(object) - raise(Aclog::Exceptions::UserProtected, object) - end + !object.protected? || + logged_in? && + (object.id == current_user.id || + current_user.account.following?(object)) when Tweet - authorize! object.user - when NilClass - raise Aclog::Exceptions::NotFound + authorized?(object.user) else - raise ArgumentError, "parameter `object` must be a User or a Tweet" + raise ArgumentError, "object must be User or Tweet" end + end + + def authorize!(object) + authorized?(object) || + raise(Aclog::Exceptions::UserProtected, object) object end |