#361

backend/app/controllers/gekanator_games_controller.rb

@@ -1,6 +1,6 @@
 class GekanatorGamesController < ApplicationController
   def create
-    return head :not_found unless current_user&.admin?
+    return head :unauthorized unless current_user
 
     guessed_post_id = params.require(:guessed_post_id)
     correct_post_id = params[:correct_post_id].presence
@@ -22,10 +22,8 @@ class GekanatorGamesController < ApplicationController
   end
 
   def extra_questions
-    return head :not_found unless current_user&.admin?
-
-    game = GekanatorGame.find_by(id: params[:id])
-    return head :not_found unless game
+    game = find_owned_game
+    return if performed?
 
     questions =
         GekanatorQuestion
@@ -45,10 +43,8 @@ class GekanatorGamesController < ApplicationController
   end
 
   def extra_question_answers
-    return head :not_found unless current_user&.admin?
-
-    game = GekanatorGame.find_by(id: params[:id])
-    return head :not_found unless game
+    game = find_owned_game
+    return if performed?
 
     answer_params = params.require(:answers)
     if !answer_params.is_a?(Array)
@@ -137,4 +133,16 @@ class GekanatorGamesController < ApplicationController
 
     question.priority_weight.to_f / (1.0 + sample_count * 0.15)
   end
+
+  def find_owned_game
+    return head :unauthorized unless current_user
+
+    game = GekanatorGame.find_by(id: params[:id])
+    return head :not_found unless game
+    if !current_user.admin? && game.user_id != current_user.id
+      return head :not_found
+    end
+
+    game
+  end
 end