comment policy and test updates

app/controllers/admin/comment_controller.rb

@@ -15,12 +15,10 @@ module Admin
     end
 
     def create
-      authorize QuizComment
-      comment = QuizComment.create(
-        comment_params.merge(user_id: current_user.id, test_hash: params[:test_hash])
-      )
+      comment = QuizComment.new(comment_params.merge(user_id: current_user.id, test_hash: params[:test_hash]))
+      authorize comment
 
-      flash_message = if comment.persisted?
+      flash_message = if comment.save
                         { success: "Sucessfully created comment" }
                       else
                         { error: "Failed to save comment" }

app/policies/quiz_comment_policy.rb

@@ -2,20 +2,18 @@
 class QuizCommentPolicy < ApplicationPolicy
   # Quiz Comment Policy
   #
-  # Anyone with access to the results can comment
-  # Only Comment owner can edit
+  # Anyone who can vote on results, can comment
+  # Only comment owner can edit her comment
+
+  def new?
+    user.acts_as_reviewer?
+  end
 
   def create?
-    user.acts_as_reviewer?
+    user.acts_as_reviewer? && record.candidate.reviewers.where(id: user.id).count.positive?
   end
 
   def update?
     user.acts_as_reviewer? && user.id == record.user_id
   end
-
-  class Scope < Scope
-    def resolve
-      true
-    end
-  end
 end

app/views/admin/result/view.html.erb

@@ -46,7 +46,7 @@
   <div class="review-comments">
     <h2 class="prft-heading">Comments</h2>
     <%= render partial: 'comment', collection: @comments, locals: { test_hash: @candidate.test_hash } %>
-    <% if policy(QuizComment).create? %>
+    <% if policy(QuizComment).new? %>
       <%= render partial: 'comment_form', locals: {comment: @comment, test_hash: @candidate.test_hash } %>
     <% end %>
   </div>