5 commits

Author	SHA1	Message	Date
Chris Flipse	464c7f863e	Update capabilities check to actually reflect the existing logic ... The OAuth capabilities are essentially user permissions that have been granted to the app. If the user authenticates through a non-oauth method, they are assumed to have granted all capabilities to the app	2018-06-17 13:57:06 -04:00
Chris Flipse	2a44ff581f	fix and improve ability coverage to account for tokens	2018-06-17 13:57:06 -04:00
Chris Flipse	060c686c19	Use cancancan to authorize user_preference_controller	2018-06-17 13:57:06 -04:00
Chris Flipse	5232914427	Implement the cancan filters for diary entries ... Access logic is not _entirely_ exported from the controller, unfortunately. For interface reasons, some actions which require admin have to be listed within the controller's deny_access method. This is required because, being a default-deny system, cancancan _cannot_ tell you the reason you were denied access; and so the "nice" feedback presenting next steps can't be gleaned from the exception	2018-06-17 13:57:06 -04:00
Chris Flipse	6da3ece683	use token in ability checks	2018-06-17 13:56:23 -04:00