- # current user is, or has :write permission on, the previous owner
- return true
- else
- logger.warn "User #{current_user.uuid} tried to modify #{self.class.to_s} #{self.uuid} but does not have permission to write #{self.owner_uuid_was}"
+ logger.warn "User #{current_user.uuid} tried to modify #{self.class.to_s} #{uuid} but does not have permission to write old owner_uuid #{owner_uuid_was}"
+ errors.add :owner_uuid, "cannot be changed without write permission on old owner"
+ raise PermissionDeniedError
+ end
+ # Verify permission to write to new owner
+ unless current_user == self or current_user.can? write: owner_uuid
+ logger.warn "User #{current_user.uuid} tried to modify #{self.class.to_s} #{uuid} but does not have permission to write new owner_uuid #{owner_uuid}"
+ errors.add :owner_uuid, "cannot be changed without write permission on new owner"