auth

.rake_tasks~

@@ -0,0 +1,74 @@
+about
+action_mailbox:ingress:exim
+action_mailbox:ingress:postfix
+action_mailbox:ingress:qmail
+action_mailbox:install
+action_mailbox:install:migrations
+action_text:install
+action_text:install:migrations
+active_storage:install
+annotate_models
+annotate_routes
+app:template
+app:update
+assets:clean[keep]
+assets:clobber
+assets:environment
+assets:precompile
+cache_digests:dependencies
+cache_digests:nested_dependencies
+db:create
+db:drop
+db:encryption:init
+db:environment:set
+db:fixtures:load
+db:migrate
+db:migrate:down
+db:migrate:redo
+db:migrate:status
+db:migrate:up
+db:prepare
+db:reset
+db:rollback
+db:schema:cache:clear
+db:schema:cache:dump
+db:schema:dump
+db:schema:load
+db:seed
+db:seed:replant
+db:setup
+db:version
+erd
+grade
+grade:all
+grade:next
+grade:reset_token
+grade_runner:runner
+importmap:install
+log:clear
+middleware
+remove_annotation
+remove_routes
+restart
+sample_data
+secret
+spec
+spec:features
+specs:readme
+stats
+stimulus:install
+stimulus:install:importmap
+stimulus:install:node
+test
+test:all
+test:db
+test:system
+time:zones[country_or_offset]
+tmp:clear
+tmp:create
+turbo:install
+turbo:install:importmap
+turbo:install:node
+turbo:install:redis
+yarn:install
+zeitwerk:check

Gemfile

@@ -3,6 +3,8 @@ git_source(:github) { |repo| "https://github.com/#{repo}.git" }
 
 ruby "3.2.1"
 
+gem "pundit"
+
 gem "simple_form"
 
 # Bundle edge Rails instead: gem "rails", github: "rails/rails", branch: "main"

Gemfile.lock

@@ -233,6 +233,8 @@ GEM
     public_suffix (5.0.1)
     puma (5.6.5)
       nio4r (~> 2.0)
+    pundit (2.3.1)
+      activesupport (>= 3.0.0)
     racc (1.6.2)
     rack (2.2.7)
     rack-protection (3.0.6)
@@ -425,6 +427,7 @@ DEPENDENCIES
   pg (~> 1.1)
   pry-rails
   puma (~> 5.0)
+  pundit
   rails (~> 7.0.4, >= 7.0.4.3)
   rails-erd
   rails_db

app/controllers/application_controller.rb

@@ -1,12 +1,27 @@
 class ApplicationController < ActionController::Base
+  include Pundit
+
+  after_action :verify_authorized, unless: :devise_controller?
+  after_action :verify_policy_scoped, only: :index, unless: :devise_controller?
+
   before_action :authenticate_user!
-
+  
   before_action :configure_permitted_parameters, if: :devise_controller?
-
+  
   protected
-
+  
   def configure_permitted_parameters
     devise_parameter_sanitizer.permit(:sign_up, keys: [:username, :private, :name, :bio, :website, :avatar_image])
     devise_parameter_sanitizer.permit(:account_update, keys: [:username, :private, :name, :bio, :website, :avatar_image])
   end
+
+  rescue_from Pundit::NotAuthorizedError, with: :user_not_authorized
+
+  private
+
+  def user_not_authorized
+    flash[:alert] = "You are not authorized to perform this action."
+
+    redirect_back fallback_location: root_url
+  end
 end

app/controllers/comments_controller.rb

@@ -1,6 +1,6 @@
 class CommentsController < ApplicationController
   before_action :set_comment, only: %i[ show edit update destroy ]
-
+  before_action :is_an_authorized_user, only: [:destroy, :create]
   # GET /comments or /comments.json
   def index
     @comments = Comment.all
@@ -58,13 +58,21 @@ def destroy
   end
 
   private
-    # Use callbacks to share common setup or constraints between actions.
-    def set_comment
-      @comment = Comment.find(params[:id])
-    end
 
-    # Only allow a list of trusted parameters through.
-    def comment_params
-      params.require(:comment).permit(:author_id, :photo_id, :body)
+  # Use callbacks to share common setup or constraints between actions.
+  def set_comment
+    @comment = Comment.find(params[:id])
+  end
+
+  def is_an_authorized_user
+    @photo = Photo.find(params.fetch(:comment).fetch(:photo_id))
+    if current_user != @photo.owner && @photo.owner.private? && !current_user.leaders.include?(@photo.owner)
+      redirect_back fallback_location: root_url, alert: "Not authorized"
     end
+  end
+
+  # Only allow a list of trusted parameters through.
+  def comment_params
+    params.require(:comment).permit(:author_id, :photo_id, :body)
+  end
 end

app/controllers/photos_controller.rb

@@ -1,18 +1,23 @@
 class PhotosController < ApplicationController
   before_action :set_photo, only: %i[ show edit update destroy ]
-
+  before_action :ensure_current_user_is_owner, only: [:destroy, :update, :edit]
+
   # GET /photos or /photos.json
   def index
     @photos = Photo.all
   end
 
   # GET /photos/1 or /photos/1.json
   def show
+    authorize @photo
   end
 
   # GET /photos/new
+
+
   def new
     @photo = Photo.new
+    authorize @photo  
   end
 
   # GET /photos/1/edit
@@ -23,6 +28,7 @@ def edit
   def create
     @photo = Photo.new(photo_params)
     @photo.owner = current_user
+    authorize @photo
 
     respond_to do |format|
       if @photo.save
@@ -50,21 +56,33 @@ def update
 
   # DELETE /photos/1 or /photos/1.json
   def destroy
-    @photo.destroy
-    respond_to do |format|
-      format.html { redirect_back fallback_location: root_url, notice: "Photo was successfully destroyed." }
-      format.json { head :no_content }
+    if current_user == @photo.owner
+      @photo.destroy
+
+      respond_to do |format|
+        format.html { redirect_back fallback_location: root_url, notice: "Photo was successfully destroyed." }
+        format.json { head :no_content }
+      end
+    else
+      redirect_back(fallback_location: root_url, notice: "Nice try, but that is not your photo.")
     end
   end
 
   private
-    # Use callbacks to share common setup or constraints between actions.
-    def set_photo
-      @photo = Photo.find(params[:id])
-    end
 
-    # Only allow a list of trusted parameters through.
-    def photo_params
-      params.require(:photo).permit(:image, :comments_count, :likes_count, :caption, :owner_id)
+  # Use callbacks to share common setup or constraints between actions.
+  def set_photo
+    @photo = Photo.find(params[:id])
+  end
+
+  def ensure_current_user_is_owner
+    if current_user != @photo.owner
+      redirect_back fallback_location: root_url, alert: "You're not authorized for that."
     end
+  end
+
+  # Only allow a list of trusted parameters through.
+  def photo_params
+    params.require(:photo).permit(:image, :comments_count, :likes_count, :caption, :owner_id)
+  end
 end

app/controllers/users_controller.rb

@@ -1,5 +1,6 @@
 class UsersController < ApplicationController
   before_action :set_user, only: %i[ show liked feed followers following discover ]
+  before_action { authorize(@user || User) }
 
   private
 
@@ -10,4 +11,4 @@ def set_user
         @user = current_user
       end
     end
-end
+end

app/models/comment.rb

@@ -22,6 +22,7 @@
 class Comment < ApplicationRecord
   belongs_to :author, class_name: "User", counter_cache: true
   belongs_to :photo, counter_cache: true
+  has_one :owner, through: :photo
 
   validates :body, presence: true
 end

app/policies/application_policy.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+class ApplicationPolicy
+  attr_reader :user, :record
+
+  def initialize(user, record)
+    @user = user
+    @record = record
+  end
+
+  def index?
+    false
+  end
+
+  def show?
+    false
+  end
+
+  def create?
+    false
+  end
+
+  def new?
+    create?
+  end
+
+  def update?
+    false
+  end
+
+  def edit?
+    update?
+  end
+
+  def destroy?
+    false
+  end
+
+  class Scope
+    def initialize(user, scope)
+      @user = user
+      @scope = scope
+    end
+
+    def resolve
+      raise NotImplementedError, "You must define #resolve in #{self.class}"
+    end
+
+    private
+
+    attr_reader :user, :scope
+  end
+end

app/policies/photo_policy.rb

@@ -0,0 +1,22 @@
+class PhotoPolicy < ApplicationPolicy
+  attr_reader :user, :photo
+
+  def initialize(user, photo)
+    @user = user
+    @photo = photo
+  end
+
+  def new?
+    user.present?
+  end
+
+  def create?
+    new?
+  end
+
+  def show?
+    user == photo.owner ||
+      !photo.owner.private? ||
+      photo.owner.followers.include?(user)
+  end
+end

app/policies/user_policy.rb

@@ -0,0 +1,28 @@
+class UserPolicy < ApplicationPolicy
+  attr_reader :current_user, :user
+
+  def initialize(current_user, user)
+    @current_user = current_user
+    @user = user
+  end
+  def discover?
+    true  
+  end
+
+  def feed?
+    true
+  end
+
+  def show?
+    user == current_user ||
+     !user.private? || 
+     user.followers.include?(current_user)
+  end
+
+  def liked?
+    user == current_user ||
+     !user.private? || 
+     user.followers.include?(current_user)
+  end
+
+end

app/views/photos/_photo.html.erb

@@ -7,13 +7,16 @@
     </h2>
 
     <div>
-      <%= link_to edit_photo_path(photo), class: "btn btn-link btn-sm text-muted" do %>
-        <i class="fas fa-edit fa-fw"></i>
-      <% end %>
+      <% if current_user == photo.owner %>
+        <%= link_to edit_photo_path(photo), class: "btn btn-link btn-sm text-muted" do %>
+          <i class="fas fa-edit fa-fw"></i>
+        <% end %>
 
-      <%= link_to photo, data: { turbo_method: :delete }, class: "btn btn-link btn-sm text-muted" do %>
-        <i class="fas fa-trash fa-fw"></i>
+        <%= link_to photo, method: :delete, class: "btn btn-link btn-sm text-muted" do %>
+          <i class="fas fa-trash fa-fw"></i>
+        <% end %>
       <% end %>
+
     </div>
   </div>