eacb4d4df3
Refactor models so that we define attribute API permissions in policy files instead of directly in models. This is cleaner because a) permissions are better handled by policies and b) which attributes are visible to the API is an API-level concern that models shouldn't have to care about. This fixes an issue with not being able to precompile CSS/JS assets unless the database was up and running. This was a problem when building Docker images because we don't have a database at build time. We needed the database because `api_attributes` was a class-level macro in some places, which meant it ran at boot time, but this triggered a database call because api_attributes used database introspection to get the list of allowed API attributes.
38 lines
703 B
Ruby
38 lines
703 B
Ruby
class DmailPolicy < ApplicationPolicy
|
|
def create?
|
|
unbanned?
|
|
end
|
|
|
|
def index?
|
|
user.is_member?
|
|
end
|
|
|
|
def mark_all_as_read?
|
|
user.is_member?
|
|
end
|
|
|
|
def update?
|
|
user.is_member? && record.owner_id == user.id
|
|
end
|
|
|
|
def show?
|
|
user.is_member? && (record.owner_id == user.id || record.valid_key?(request.params[:key]))
|
|
end
|
|
|
|
def reportable?
|
|
unbanned? && record.owner_id == user.id && record.is_recipient? && !record.is_automated? && !record.from.is_moderator?
|
|
end
|
|
|
|
def permitted_attributes_for_create
|
|
[:title, :body, :to_name, :to_id]
|
|
end
|
|
|
|
def permitted_attributes_for_update
|
|
[:is_read, :is_deleted]
|
|
end
|
|
|
|
def api_attributes
|
|
super + [:key]
|
|
end
|
|
end
|