[bugfix] Make sure API users with edit rights can PUT updates

nulib · Feb 23, 2023 · be013f3 · be013f3
1 parent f1c8c3d
commit be013f3
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/app/models/ability.rb b/app/models/ability.rb
@@ -161,6 +161,11 @@ def custom_permissions(user=nil, session=nil)
         # anyone who can edit a media_object can also push it
         can? :edit, media_object
       end
+
+      can :json_update, MediaObject do |media_object|
+        # anyone who can edit a media_object can also update it via the API
+        is_api_request? && can?(:edit, media_object)
+      end
     end
   end