6671711784
Refactor email verification links and Dmail share links to use the new Rails signed_id mechanism, rather than our own handrolled mechanism. For Dmail share links, we have to override some Rails internal methods so that our old links still work. For email verification links, this will invalidate existing links, but this isn't a huge deal since these links are short-lived anyway. https://api.rubyonrails.org/classes/ActiveRecord/SignedId.html https://api.rubyonrails.org/classes/ActiveRecord/SignedId/ClassMethods.html
24 lines
459 B
Ruby
24 lines
459 B
Ruby
class EmailAddressPolicy < ApplicationPolicy
|
|
def index?
|
|
user.is_moderator?
|
|
end
|
|
|
|
def show?
|
|
record.user_id == user.id || (user.is_moderator? && record.user.level < user.level)
|
|
end
|
|
|
|
def update?
|
|
# XXX here record is a user, not the email address.
|
|
record.id == user.id
|
|
end
|
|
|
|
def verify?
|
|
record.user_id == user.id
|
|
end
|
|
|
|
def send_confirmation?
|
|
# XXX record is a user, not the email address.
|
|
record.id == user.id
|
|
end
|
|
end
|