Extract authorization policy for viewing statuses (#3150)

2017-05-29 18:22:22 +02:00
1 parent 9a81be0d37
commit 3a2003ba86
@@ -1,12 +1,14 @@
 # frozen_string_literal: true

 class Api::Activitypub::NotesController < ApiController
+  include Authorization
+
  before_action :set_status

  respond_to :activitystreams2

  def show
-    forbidden unless @status.permitted?
+    authorize @status, :show?
  end

  private