first commit, largely copied volunteers

app/policies/application_policy.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+class ApplicationPolicy
+  attr_reader :member, :record
+
+  def initialize(member, record)
+    @member = member
+    @record = record
+  end
+
+  def index?
+    false
+  end
+
+  def show?
+    false
+  end
+
+  def create?
+    false
+  end
+
+  def new?
+    create?
+  end
+
+  def update?
+    false
+  end
+
+  def edit?
+    update?
+  end
+
+  def destroy?
+    false
+  end
+
+  class Scope
+    def initialize(member, scope)
+      @member = member
+      @scope = scope
+    end
+
+    def resolve
+      raise NotImplementedError, "You must define #resolve in #{self.class}"
+    end
+
+    private
+
+    attr_reader :member, :scope
+  end
+end

app/policies/edit_own_policy.rb

@@ -0,0 +1,14 @@
+# allows to edit/detroy own data
+# which can be viewed by anyone
+class EditOwnPolicy < ApplicationPolicy
+  def edit?
+    return true if member.admin?
+    owner?
+  end
+  def owner?
+    member == record.member
+  end
+  alias :update? :edit?
+  alias :destroy? :edit?
+
+end

app/policies/picture_policy.rb

@@ -0,0 +1,3 @@
+class PicturePolicy < EditOwnPolicy
+
+end

app/policies/story_policy.rb

@@ -0,0 +1,3 @@
+class StoryPolicy < EditOwnPolicy
+
+end