From 77f11100204bd68e5a6b887ec000f124806279bd Mon Sep 17 00:00:00 2001
From: "Stanko K.R." <stanko@stanko.io>
Date: Wed, 3 Dec 2025 11:10:44 +0100
Subject: [PATCH] Allow only the owner of a reaction to delete it

---
 .../cards/comments/reactions_controller.rb          |  7 ++++++-
 .../cards/comments/reactions_controller_test.rb     | 13 +++++++++++--
 2 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/app/controllers/cards/comments/reactions_controller.rb b/app/controllers/cards/comments/reactions_controller.rb
index 54f63dda7..5d5814503 100644
--- a/app/controllers/cards/comments/reactions_controller.rb
+++ b/app/controllers/cards/comments/reactions_controller.rb
@@ -15,7 +15,12 @@ class Cards::Comments::ReactionsController < ApplicationController
 
   def destroy
     @reaction = @comment.reactions.find(params[:id])
-    @reaction.destroy
+
+    if Current.user != @reaction.reacter
+      head :forbidden
+    else
+      @reaction.destroy
+    end
   end
 
   private
diff --git a/test/controllers/cards/comments/reactions_controller_test.rb b/test/controllers/cards/comments/reactions_controller_test.rb
index bf948743b..57d635e96 100644
--- a/test/controllers/cards/comments/reactions_controller_test.rb
+++ b/test/controllers/cards/comments/reactions_controller_test.rb
@@ -2,7 +2,7 @@ require "test_helper"
 
 class Cards::Comments::ReactionsControllerTest < ActionDispatch::IntegrationTest
   setup do
-    sign_in_as :jz
+    sign_in_as :david
     @comment = comments(:logo_agreement_jz)
     @card = @comment.card
   end
@@ -15,10 +15,19 @@ class Cards::Comments::ReactionsControllerTest < ActionDispatch::IntegrationTest
   end
 
   test "destroy" do
-    reaction = reactions(:kevin)
+    reaction = reactions(:david)
     assert_difference -> { @comment.reactions.count }, -1 do
       delete card_comment_reaction_path(@comment.card, @comment, reaction, format: :turbo_stream)
       assert_turbo_stream action: :remove, target: dom_id(reaction)
     end
   end
+
+  test "non-owner cannot destroy reaction" do
+    reaction = reactions(:kevin)
+
+    assert_no_difference -> { @comment.reactions.count } do
+      delete card_comment_reaction_path(@comment.card, @comment, reaction, format: :turbo_stream)
+      assert_response :forbidden
+    end
+  end
 end