1 files changed, 14 insertions, 0 deletions
diff --git a/routes/note_fragment.php b/routes/note_fragment.php
index e9a7396..ac7927c 100644
--- a/routes/note_fragment.php
+++ b/routes/note_fragment.php
@@ -3,6 +3,7 @@
 use Digitigrade\FormattingProvider\CommonMark;
 use Digitigrade\HttpResponseStatus\BadRequest;
 use Digitigrade\HttpResponseStatus\Forbidden;
+use Digitigrade\HttpResponseStatus\PolicyRejected;
 use Digitigrade\Model\Actor;
 use Digitigrade\Model\Interaction;
 use Digitigrade\Model\InteractionKind;
@@ -11,6 +12,7 @@ use Digitigrade\Model\NoteAttachment;
 use Digitigrade\Model\NotePrivacyScope;
 use Digitigrade\Model\StorageObject;
 use Digitigrade\Model\UserAccount;
+use Digitigrade\PolicyManager;
 use Digitigrade\Router;
 use Digitigrade\StorageProvider;
 use Digitigrade\StorageProvider\FilesystemStorage;
@@ -47,6 +49,10 @@ Router::getInstance()->mount('/fragment/note/:id/:action', function (array $args
     if ($interaction == null) {
         // we are adding a new interaction
         $interaction = Interaction::create($user->actor, InteractionKind::from($action), $note);
+        if (!PolicyManager::getInstance()->check($interaction)) {
+            $interaction->remove();
+            throw new PolicyRejected();
+        }
         $interaction->publish();
         $interaction->processTimelineAdditions();
         $interaction->processNotifications();
@@ -90,6 +96,10 @@ Router::getInstance()->mount('/fragment/note/:id/reply', function (array $args)
             $reply->mentions[] = Actor::find($uid);
         }
         $reply->generateLinkPreviews();
+        if (!PolicyManager::getInstance()->check($reply)) {
+            $reply->remove();
+            throw new PolicyRejected();
+        }
         $reply->save();
         $reply->publish();
         $reply->processTimelineAdditions();
@@ -128,6 +138,10 @@ Router::getInstance()->mount('/fragment/note', function (array $args) {
             $note->attachments[] = NoteAttachment::fromStorageObject($obj, $index++, $altTexts[$i] ?: null);
         }
         $note->generateLinkPreviews();
+        if (!PolicyManager::getInstance()->check($note)) {
+            $note->remove();
+            throw new PolicyRejected();
+        }
         $note->save();
         $note->publish();
         $note->processTimelineAdditions();