Update ReadingListItemsController#update to return NotAuthorized (#5658)

* change ReadingListItemsController#update to return NotAuthorized if user_id does not match

* fix spec description

Co-authored-by: rhymes <rhymesete@gmail.com>

app/controllers/reading_list_items_controller.rb

@@ -7,7 +7,7 @@ class ReadingListItemsController < ApplicationController
 
   def update
     @reaction = Reaction.find(params[:id])
-    raise if @reaction.user_id != session_current_user_id # Lazy but I'm tired. HACK
+    not_authorized if @reaction.user_id != session_current_user_id
 
     @reaction.status = params[:current_status] == "archived" ? "valid" : "archived"
     @reaction.save

spec/requests/reading_list_items_spec.rb

@@ -2,8 +2,10 @@ require "rails_helper"
 
 RSpec.describe "ReadingListItems", type: :request do
   let(:user) { create(:user) }
+  let(:separate_user) { create(:user) }
   let(:article) { create(:article, user_id: user.id) }
   let(:reaction) { create(:reaction, reactable: article, user_id: user.id) }
+  let(:unauthorized_reaction) { create(:reaction, reactable: article, user_id: separate_user.id) }
 
   before do
     sign_in user
@@ -26,5 +28,9 @@ RSpec.describe "ReadingListItems", type: :request do
       put "/reading_list_items/#{reaction.id}", params: { current_status: "archived" }
       expect(reaction.reload.status).to eq("valid")
     end
+
+    it "raises NotAuthorizedError if current_user is not the reaction user" do
+      expect { put "/reading_list_items/#{unauthorized_reaction.id}" }.to raise_error Pundit::NotAuthorizedError
+    end
   end
 end