change publisher controller to only an curator user can publish

app/controllers/concerns/submission_controller.rb

@@ -25,7 +25,7 @@ module SubmissionController
     private
 
     def submitted
-        return @learning_object.state == "submitted"
+        return @learning_object.submitted?
     end
 
     def set_new_submission

app/controllers/v1/learning_objects/publishes_controller.rb

@@ -20,7 +20,7 @@ class V1::LearningObjects::PublishesController < ApplicationController
   end
 
   def authorize!
-    authorize(@learning_object || LearningObject.new, :update?)
+    authorize(@learning_object, :publish?)
   end
 
   # Never trust parameters from the scary internet, only allow the white list through.

app/policies/learning_object_policy.rb

@@ -26,6 +26,10 @@ class LearningObjectPolicy < ApplicationPolicy
     record if owns?
   end
 
+  def publish?
+    record if user_can_curate? && record.submitted?
+  end
+
   def destroy?
     record if owns?
   end