eacb4d4df3
Refactor models so that we define attribute API permissions in policy files instead of directly in models. This is cleaner because a) permissions are better handled by policies and b) which attributes are visible to the API is an API-level concern that models shouldn't have to care about. This fixes an issue with not being able to precompile CSS/JS assets unless the database was up and running. This was a problem when building Docker images because we don't have a database at build time. We needed the database because `api_attributes` was a class-level macro in some places, which meant it ran at boot time, but this triggered a database call because api_attributes used database introspection to get the list of allowed API attributes.
30 lines
486 B
Ruby
30 lines
486 B
Ruby
class PoolPolicy < ApplicationPolicy
|
|
def gallery?
|
|
index?
|
|
end
|
|
|
|
def update?
|
|
unbanned? && (!record.is_deleted? || user.is_builder?)
|
|
end
|
|
|
|
def destroy?
|
|
!record.is_deleted? && user.is_builder?
|
|
end
|
|
|
|
def undelete?
|
|
record.is_deleted? && user.is_builder?
|
|
end
|
|
|
|
def revert?
|
|
update?
|
|
end
|
|
|
|
def permitted_attributes
|
|
[:name, :description, :category, :post_ids, :post_ids_string, post_ids: []]
|
|
end
|
|
|
|
def api_attributes
|
|
super + [:post_count]
|
|
end
|
|
end
|