Merge pull request #372 from basecamp/scope-accesses

Scope data by account

app/controllers/comments/reactions_controller.rb

@@ -24,7 +24,7 @@ class Comments::ReactionsController < ApplicationController
 
   private
     def set_comment
-      @comment = Comment.find(params[:comment_id])
+      @comment = Current.account.comments.find(params[:comment_id])
     end
 
     def reaction_params

app/controllers/concerns/bubble_scoped.rb

@@ -7,8 +7,7 @@ module BubbleScoped
 
   private
     def set_bubble
-      # Finding the bubble on the root depends on checking permission by finding its bucket via Current.user
-      @bubble = Bubble.find(params[:bubble_id])
+      @bubble = Current.user.accessible_bubbles.find(params[:bubble_id])
     end
 
     def set_bucket

app/models/account.rb

@@ -10,6 +10,8 @@ class Account < ApplicationRecord
     end
   end
 
+  has_many :comments, through: :users
+
   has_many :workflows, dependent: :destroy
   has_many :stages, through: :workflows, class_name: "Workflow::Stage"
 

app/models/event/particulars.rb

@@ -10,6 +10,6 @@ module Event::Particulars
   end
 
   def comment
-    @comment ||= Comment.find_by(id: comment_id)
+    @comment ||= account.comments.find_by(id: comment_id)
   end
 end

app/models/user.rb

@@ -6,6 +6,8 @@ class User < ApplicationRecord
   has_many :sessions, dependent: :destroy
   has_secure_password validations: false
 
+  has_many :comments, inverse_of: :creator, dependent: :destroy
+
   has_many :notifications, dependent: :destroy
 
   has_many :filters, foreign_key: :creator_id, inverse_of: :creator, dependent: :destroy