Can't upload to other people's album

app/models/album.rb

@@ -14,7 +14,7 @@ class Album
 
   timestamps!
 
-  validates_presence_of :name
+  validates_presence_of :name, :person
 
   before_destroy :destroy_photos
   after_save :notify_people

app/models/photo.rb

@@ -22,8 +22,12 @@ class Photo < Post
     photo
   end
   
-  after_save :log_inspection 
+  after_save :log_save_inspection 
+  validates_true_for :album_id, :logic => lambda {self.validate_album_person}
 
+  def validate_album_person
+    album.person_id == person_id
+  end
   def remote_photo
     @remote_photo ||= User.owner.url.chop + image.url
   end

app/views/albums/show.html.haml

@@ -1,5 +1,6 @@
 %h3= @album.name
-= render "photos/new_photo", :photo => @photo, :album => @album
+-if mine? @album
+  = render "photos/new_photo", :photo => @photo, :album => @album
 - for photo in @album_photos
   = link_to (image_tag photo.image.url(:thumb_medium)), object_path(photo)
 

spec/models/album_spec.rb

@@ -3,10 +3,12 @@ require File.dirname(__FILE__) + '/../spec_helper'
 describe Album do
   before do
     @user = Factory.create(:user)
-    @album = Album.new(:name => "test collection")
+    @album = Album.new(:name => "test collection", :person => @user)
   end
 
   it 'should belong to a person' do
+    @album.person = nil
+    @album.valid?.should be false
     person = Factory.create(:person)
     @album.person = person
     @album.valid?.should be true
@@ -23,7 +25,7 @@ describe Album do
   end
 
   it 'should contain photos' do
-    album = Album.create(:name => "test collection")
+    album = Album.create(:name => "test collection", :person => @user)
     photo = Factory.build(:photo, :person => @user)
 
     album.photos << photo
@@ -44,7 +46,6 @@ describe Album do
 
   describe 'traversing' do
     before do
-      @album = Album.create(:name => "test collection")
       @photo_one = Factory.create(:photo, :person => @user, :album => @album, :created_at => Time.now)
       @photo_two = Factory.create(:photo, :person => @user, :album => @album, :created_at => Time.now+1)
       @photo_three = Factory.create(:photo, :person => @user, :album => @album, :created_at => Time.now+2)
@@ -73,8 +74,6 @@ describe Album do
 
   describe 'serialization' do
     before do
-      @album.person = @user
-      @album.save
       @xml = @album.to_xml.to_s
     end
     it 'should have a person' do