diff --git a/app/controllers/concerns/publisher_controller.rb b/app/controllers/concerns/publisher_controller.rb index 6e02bf295460ceb3ba34e101f1cf94d75da1ee88..c0d2acf15018424b9eeffd1752e2fd573bd2f5c4 100644 --- a/app/controllers/concerns/publisher_controller.rb +++ b/app/controllers/concerns/publisher_controller.rb @@ -17,7 +17,7 @@ module PublisherController end def show_all_collections - render json: ::UserPolicy::Scope.new(current_user,Collection).resolve.where(owner: @publisher) + render json: ::UserPolicy::Scope.new(current_user, @publisher, Collection).resolve.where(owner: @publisher) end def show_liked_learning_objects diff --git a/app/policies/publisher_policy.rb b/app/policies/publisher_policy.rb index 0eee77811469fbdf4cad4619a1145b4177088e34..1da55efa6a5d9278f9825d2e174d261f25d5bef2 100644 --- a/app/policies/publisher_policy.rb +++ b/app/policies/publisher_policy.rb @@ -1,10 +1,18 @@ module PublisherPolicy class Scope < ApplicationPolicy::Scope + attr_reader :user, :record, :scope + + def initialize(user, record, scope) + @user = user + @record = user + @scope = scope + end + def resolve if user.nil? scope.where(privacy: 'public') - elsif user.is_admin? || same_user? + elsif user.is_admin? || record == user scope.all else scope.where(privacy: 'public')