API: correct like and comment scopes for private posts

This commit is contained in:
Jonne Haß 2020-01-30 23:42:09 +01:00
parent fbd0a51829
commit 0754c92116
2 changed files with 3 additions and 3 deletions

View file

@ -8,7 +8,7 @@ module Api
end
before_action only: %i[create destroy] do
require_access_token %w[interactions public:modify]
require_access_token %w[interactions public:read]
end
rescue_from ActiveRecord::RecordNotFound do

View file

@ -31,7 +31,7 @@ module Api
def create
post = post_service.find!(params.require(:post_id))
raise ActiveRecord::RecordInvalid unless post.public? || private_modify?
raise ActiveRecord::RecordInvalid unless post.public? || private_read?
like_service.create(params[:post_id])
rescue ActiveRecord::RecordInvalid => e
@ -46,7 +46,7 @@ module Api
def destroy
post = post_service.find!(params.require(:post_id))
raise ActiveRecord::RecordInvalid unless post.public? || private_modify?
raise ActiveRecord::RecordInvalid unless post.public? || private_read?
success = like_service.unlike_post(params[:post_id])
if success