Enable private doodads

app/controllers/doodads_controller.rb

@@ -3,7 +3,7 @@ class DoodadsController < ApplicationController
 
   # GET /doodads or /doodads.json
   def index
-    @doodads = authorize policy_scope(Doodad)
+    authorize @doodads = policy_scope(Doodad)
   end
 
   # GET /doodads/1 or /doodads/1.json

app/controllers/visitors_controller.rb

@@ -2,7 +2,7 @@ class VisitorsController < ApplicationController
   before_action :skip_authorization
 
   def index
-    @doodads = authorize Doodad.all
+    @doodads = authorize policy_scope(Doodad)
     @canisters = authorize Canister.all
   end
 end

app/policies/doodad_policy.rb

@@ -42,11 +42,11 @@ class DoodadPolicy
   end
 
   def edit?
-    @user.admin? || @user == @doodad.user || @doodad.user.nil?
+   @user.admin? || @user == @doodad.user || (@doodad.is_public? && @doodad.user.nil?)
   end
 
   def update?
-    @user.admin? || @user == @doodad.user || @doodad.user.nil?
+    @user.admin? || @user == @doodad.user || (@doodad.is_public? && @doodad.user.nil?)
   end
 
   def destroy?

app/views/doodads/_doodad.html.haml

@@ -1,3 +1,5 @@
-.doodad
-  = doodad.body.html_safe
-  = link_to 'Edit', edit_doodad_path(doodad)
+- if policy(doodad).show?
+  .doodad
+    = doodad.body.html_safe
+    - if policy(doodad).edit?
+      = link_to 'Edit', edit_doodad_path(doodad)