Merge pull request #158 from solidusio-contrib/aldesantis/guest-token

Enable authorization via guest tokens

1 files changed, 19 insertions, 0 deletions

diff --git a/lib/solidus_subscriptions/permission_sets/subscription_management.rb b/lib/solidus_subscriptions/permission_sets/subscription_management.rb
new file mode 100644
index 0000000..c669368
--- /dev/null
+++ b/lib/solidus_subscriptions/permission_sets/subscription_management.rb
@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module SolidusSubscriptions
+  module PermissionSets
+    class SubscriptionManagement < ::Spree::PermissionSets::Base
+      def activate!
+        can :manage, Subscription do |subscription, guest_token|
+          (subscription.guest_token.present? && subscription.guest_token == guest_token) ||
+            (subscription.user && subscription.user == user)
+        end
+
+        can :manage, LineItem do |line_item, guest_token|
+          (line_item.subscription&.guest_token.present? && line_item.subscription.guest_token == guest_token) ||
+            (line_item.subscription&.user && line_item.subscription.user == user)
+        end
+      end
+    end
+  end
+end