Hail Mary update for the Score controller.v1.0

Try to prevent scores editing from modifying scores of a different
session.

1 files changed, 6 insertions, 1 deletions

diff --git a/app/controllers/scores_controller.rb b/app/controllers/scores_controller.rb
index 7c46165..16e0e44 100644
--- a/app/controllers/scores_controller.rb
+++ b/app/controllers/scores_controller.rb
@@ -1,6 +1,7 @@
 class ScoresController < ApplicationController
   allow_unauthenticated_access
   before_action :set_tartiflette, only: [ :new, :create, :edit_all, :update_all ]
+  before_action :ensure_session_id, only: [:edit_all, :update_all]
 
   def new
   end
@@ -10,7 +11,7 @@ class ScoresController < ApplicationController
   end
 
   def edit_all
-    @scores = @tartiflette.scores
+    @scores = @tartiflette.scores.where(session_id: session[:id])
   end
 
   def update_all
@@ -23,6 +24,10 @@ class ScoresController < ApplicationController
     @tartiflette = Tartiflette.find(params[:tartiflette_id])
   end
 
+  def ensure_session_id
+    session[:id] ||= SecureRandom.uuid
+  end
+
   def scores_params
     params.require(:scores).permit!.to_h
   end