|
|
|
|
@ -38,12 +38,12 @@ module Api
|
|
|
|
|
private
|
|
|
|
|
|
|
|
|
|
def authorization_check!(blob)
|
|
|
|
|
is_authorized =
|
|
|
|
|
blob.attachments.all? do |a|
|
|
|
|
|
a.name.in?(%w[logo preview_images]) ||
|
|
|
|
|
(current_user && a.record.account.id == current_user.account_id) ||
|
|
|
|
|
!a.record.account.account_configs.find_or_initialize_by(key: AccountConfig::DOWNLOAD_LINKS_AUTH_KEY).value
|
|
|
|
|
end
|
|
|
|
|
attachment = blob.attachments.take
|
|
|
|
|
|
|
|
|
|
is_authorized = attachment.name.in?(%w[logo preview_images]) ||
|
|
|
|
|
(current_user && attachment.record.account.id == current_user.account_id) ||
|
|
|
|
|
!attachment.record.account.account_configs
|
|
|
|
|
.find_or_initialize_by(key: AccountConfig::DOWNLOAD_LINKS_AUTH_KEY).value
|
|
|
|
|
|
|
|
|
|
return if is_authorized
|
|
|
|
|
|
|
|
|
|
|