MushroomObserver / mushroom-observer / 31980362978

99%

main: 99%

Pull #5095

github

Fix missing authorization check on Descriptions::AuthorsController#create/#destroy

Confirmed via Copilot review, and verified pre-existing (predates this
branch, present since the controller's original ERB-era version):
`create` and `destroy` never checked whether the current user is an
author or reviewer, unlike `show`. Any logged-in user could add or
remove a description's authors via a direct POST/DELETE, given the
right ids, with no permission check in the way.

Extracts `show`'s existing check into a shared `authorized?` guard
used by all three actions.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

193 of 197 new or added lines in 68 files covered. (97.97%)

55162 of 55561 relevant lines covered (99.28%)

863.65 hits per line