Fix #4374: Unvoting comments is broken.

app/controllers/comment_votes_controller.rb

@@ -10,13 +10,13 @@ class CommentVotesController < ApplicationController
   end
 
   def create
-    @comment = authorize Comment.find(params[:comment_id])
+    @comment = authorize Comment.find(params[:comment_id]), policy_class: CommentVotePolicy
     @comment_vote = @comment.vote!(params[:score])
     respond_with(@comment)
   end
 
   def destroy
-    @comment = authorize Comment.find(params[:comment_id])
+    @comment = authorize Comment.find(params[:comment_id]), policy_class: CommentVotePolicy
     @comment.unvote!
     respond_with(@comment)
   end

app/policies/comment_vote_policy.rb

@@ -1,2 +1,6 @@
 class CommentVotePolicy < ApplicationPolicy
+  def destroy?
+    # XXX permissions are checked in Comment#unvote!
+    true
+  end
 end

test/functional/comment_votes_controller_test.rb

@@ -13,6 +13,15 @@ class CommentVotesControllerTest < ActionDispatch::IntegrationTest
       CurrentUser.ip_addr = nil
     end
 
+    context "#index" do
+      should "work" do
+        create(:comment_vote, user: @user)
+        get_auth comment_votes_path, @user
+
+        assert_response :success
+      end
+    end
+
     context "#create.json" do
       should "create a vote" do
         assert_difference("CommentVote.count", 1) do
@@ -53,5 +62,25 @@ class CommentVotesControllerTest < ActionDispatch::IntegrationTest
         end
       end
     end
+
+    context "#destroy" do
+      should "allow users to remove their own comment votes" do
+        @vote = create(:comment_vote, user: @user)
+
+        assert_difference("CommentVote.count", -1) do
+          delete_auth comment_comment_votes_path(@vote.comment), @user
+          assert_redirected_to @vote.comment
+        end
+      end
+
+      should "not allow users to remove comment votes by other users" do
+        @vote = create(:comment_vote)
+
+        assert_difference("CommentVote.count", 0) do
+          delete_auth comment_comment_votes_path(@vote.comment), @user
+          assert_response 422
+        end
+      end
+    end
   end
 end