about summary refs log tree commit diff
path: root/app/controllers/api/v1
diff options
context:
space:
mode:
authorThibaut Girka <thib@sitedethib.com>2019-06-04 20:40:19 +0200
committerThibaut Girka <thib@sitedethib.com>2019-06-04 20:40:19 +0200
commit02b56c7e1a0fa561af9a85f765ec22eee3053561 (patch)
treeba851bcad4bf9f657a0c2414ac3befdea9acea15 /app/controllers/api/v1
parent58946fef3c05342289c1c50132996fc4fd01cf68 (diff)
parent48fee1a800a262ce26171d724c15738d083eb6d6 (diff)
Merge remote-tracking branch 'upstream/master' into glitch-soc/merge-upstream
Diffstat (limited to 'app/controllers/api/v1')
-rw-r--r--app/controllers/api/v1/polls_controller.rb17
1 files changed, 16 insertions, 1 deletions
diff --git a/app/controllers/api/v1/polls_controller.rb b/app/controllers/api/v1/polls_controller.rb
index 4f4a6858d..031e6d42d 100644
--- a/app/controllers/api/v1/polls_controller.rb
+++ b/app/controllers/api/v1/polls_controller.rb
@@ -1,13 +1,28 @@
 # frozen_string_literal: true
 
 class Api::V1::PollsController < Api::BaseController
+  include Authorization
+
   before_action -> { authorize_if_got_token! :read, :'read:statuses' }, only: :show
+  before_action :set_poll
+  before_action :refresh_poll
 
   respond_to :json
 
   def show
+    render json: @poll, serializer: REST::PollSerializer, include_results: true
+  end
+
+  private
+
+  def set_poll
     @poll = Poll.attached.find(params[:id])
+    authorize @poll.status, :show?
+  rescue Mastodon::NotPermittedError
+    raise ActiveRecord::RecordNotFound
+  end
+
+  def refresh_poll
     ActivityPub::FetchRemotePollService.new.call(@poll, current_account) if user_signed_in? && @poll.possibly_stale?
-    render json: @poll, serializer: REST::PollSerializer, include_results: true
   end
 end