authorizing destroy reviews requests

app/controllers/concerns/reviewable_controller.rb

@@ -45,7 +45,7 @@ module ReviewableController
     rate = Rate.where(user: current_user, review: @review).first_or_initialize
 
     if rate.update(approves: approves)
-      render json: rate, status: :ok
+      render json: rate, status: :created
     else
       render json: rate.errors, status: :unprocessable_entity
     end

app/policies/review_policy.rb

@@ -5,18 +5,20 @@ class ReviewPolicy < ApplicationPolicy
   end
 
   def update?
-    record if owns?
+    record if own?
   end
 
   def destroy?
-    record if record.user == user
+    record if own?
   end
 
   def rate?
     record if user_exists?
   end
 
-  def owner
-    record.users
+  private
+
+  def own?
+    record.user == user
   end
 end

config/routes.rb

@@ -35,7 +35,6 @@ Rails.application.routes.draw do
     mount_devise_token_auth_for 'User', skip: [:omniauth_callbacks], at: :auth
   end
 
-  # devise_for :users, :controllers => { :omniauth_callbacks => "callbacks" }
   namespace :v1 do
     resources :users, concerns: :followable do
       member do