Update controllers to properly authorize

For some of these, they weren't authorizing at all, so this is a good safety improvement

app/controllers/api/v1/grid_characters_controller.rb

@@ -7,7 +7,7 @@ module Api
 
       before_action :find_party, only: :create
       before_action :set, only: %i[update destroy]
-      before_action :check_authorization, only: %i[update destroy]
+      before_action :authorize, only: %i[create update destroy]
       before_action :find_incoming_character, only: :create
       before_action :find_current_characters, only: :create
 
@@ -135,8 +135,12 @@ module Api
         render_unauthorized_response if current_user && (party.user != current_user)
       end
 
-      def check_authorization
+      def authorize
-        render_unauthorized_response if @character.party.user != current_user
+        # Create
+        unauthorized_create = @party && (@party.user != current_user || @party.edit_key != edit_key)
+        unauthorized_update = @character && @character.party && (@character.party.user != current_user || @character.party.edit_key != edit_key)
+
+        render_unauthorized_response if unauthorized_create || unauthorized_update
       end
 
       # Specify whitelisted properties that can be modified.

app/controllers/api/v1/grid_summons_controller.rb

@@ -3,12 +3,12 @@
 module Api
   module V1
     class GridSummonsController < Api::V1::ApiController
-      before_action :set, only: %w[update destroy]
-
       attr_reader :party, :incoming_summon
-
+      
+      before_action :set, only: %w[update destroy]
       before_action :find_party, only: :create
       before_action :find_incoming_summon, only: :create
+      before_action :authorize, only: %i[create update destroy]
 
       def create
         # Create the GridSummon with the desired parameters
@@ -94,6 +94,14 @@ module Api
                                    meta: { replaced: conflict_position })
       end
 
+      def authorize
+        # Create
+        unauthorized_create = @party && (@party.user != current_user || @party.edit_key != edit_key)
+        unauthorized_update = @summon && @summon.party && (@summon.party.user != current_user || @summon.party.edit_key != edit_key)
+
+        render_unauthorized_response if unauthorized_create || unauthorized_update
+      end
+
       def set
         @summon = GridSummon.where('id = ?', params[:id]).first
       end

app/controllers/api/v1/grid_weapons_controller.rb

@@ -3,12 +3,12 @@
 module Api
   module V1
     class GridWeaponsController < Api::V1::ApiController
-      before_action :set, except: %w[create update_uncap_level]
-
       attr_reader :party, :incoming_weapon
 
+      before_action :set, except: %w[create update_uncap_level]
       before_action :find_party, only: :create
       before_action :find_incoming_weapon, only: :create
+      before_action :authorize, only: %i[create update destroy]
 
       def create
         # Create the GridWeapon with the desired parameters
@@ -121,15 +121,15 @@ module Api
       # Render the conflict view as a string
       def render_conflict_view(conflict_weapon, incoming_weapon, incoming_position)
         ConflictBlueprint.render(nil, view: :weapons,
-                                      conflict_weapon: conflict_weapon,
+                                 conflict_weapon: conflict_weapon,
-                                      incoming_weapon: incoming_weapon,
+                                 incoming_weapon: incoming_weapon,
-                                      incoming_position: incoming_position)
+                                 incoming_position: incoming_position)
       end
 
       def render_grid_weapon_view(grid_weapon, conflict_position)
         GridWeaponBlueprint.render(grid_weapon, view: :full,
-                                                root: :grid_weapon,
+                                   root: :grid_weapon,
-                                                meta: { replaced: conflict_position })
+                                   meta: { replaced: conflict_position })
       end
 
       def save_weapon(weapon)
@@ -183,6 +183,15 @@ module Api
         @weapon = GridWeapon.where('id = ?', params[:id]).first
       end
 
+      def authorize
+        # Create
+        ap @party
+        unauthorized_create = @party && (@party.user != current_user || @party.edit_key != edit_key)
+        unauthorized_update = @weapon && @weapon.party && (@weapon.party.user != current_user || @weapon.party.edit_key != edit_key)
+
+        render_unauthorized_response if unauthorized_create || unauthorized_update
+      end
+
       # Specify whitelisted properties that can be modified.
       def weapon_params
         params.require(:weapon).permit(

app/controllers/api/v1/jobs_controller.rb

@@ -4,6 +4,7 @@ module Api
   module V1
     class JobsController < Api::V1::ApiController
       before_action :set, only: %w[update_job update_job_skills]
+      before_action :authorize, only: %w[update_job update_job_skills]
 
       def all
         render json: JobBlueprint.render(Job.all)
@@ -165,6 +166,10 @@ module Api
         end
       end
 
+      def authorize
+        render_unauthorized_response if @party.user != current_user || @party.edit_key != edit_key
+      end
+
       def set
         @party = Party.where('id = ?', params[:id]).first
       end

app/controllers/api/v1/parties_controller.rb

@@ -6,6 +6,7 @@ module Api
       before_action :set_from_slug,
                     except: %w[create destroy update index favorites]
       before_action :set, only: %w[update destroy]
+      before_action :authorize, only: %w[update destroy]
 
       def create
         party = Party.new
@@ -40,8 +41,6 @@ module Api
       end
 
       def update
-        render_unauthorized_response if @party.user != current_user
-
         @party.attributes = party_params.except(:skill1_id, :skill2_id, :skill3_id)
 
         # TODO: Validate accessory with job
@@ -52,7 +51,6 @@ module Api
       end
 
       def destroy
-        render_unauthorized_response if @party.user != current_user
         return render json: PartyBlueprint.render(@party, view: :destroyed, root: :checkin) if @party.destroy
       end
 
@@ -123,6 +121,10 @@ module Api
 
       private
 
+      def authorize
+        render_unauthorized_response if @character.party.user != current_user || @party.edit_key != edit_key
+      end
+
       def build_conditions(params)
         unless params['recency'].blank?
           start_time = (DateTime.current - params['recency'].to_i.seconds)
@@ -174,6 +176,7 @@ module Api
         params.require(:party).permit(
           :user_id,
           :local_id,
+          :edit_key,
           :extra,
           :name,
           :description,