DRY up 'read' scope auth in v2 API controllers

Move the "read" scope authorization check to a shared `before_action` in `BaseApiController`
- Removes redundant checks from individual actions in `PlansController` and `TemplatesController`
- Allows for the safe removal of `@scopes` from `base_response_content`

Author: aaronskiba

app/controllers/api/v2/base_api_controller.rb

@@ -13,6 +13,7 @@ class BaseApiController < ApplicationController # rubocop:todo Style/Documentati
 
       before_action :log_access
 
+      before_action :require_read_scope, except: %i[heartbeat me]
       # controller can respond to json format requests
       respond_to :json
 
@@ -43,7 +44,6 @@ def base_response_content
         @application = ApplicationService.application_name
         @client = doorkeeper_token&.application
         @caller = @client&.name || request.remote_ip
-        @scopes = doorkeeper_token.scopes.to_a if doorkeeper_token
         return unless doorkeeper_token&.resource_owner_id
 
         @resource_owner = User.find(doorkeeper_token.resource_owner_id)
@@ -95,6 +95,10 @@ def paginate_response(results:)
         @total_items = results.total_count
         results
       end
+
+      def require_read_scope
+        raise Pundit::NotAuthorizedError unless doorkeeper_token.scopes.include?('read')
+      end
     end
   end
 end

app/controllers/api/v2/plans_controller.rb

@@ -8,8 +8,6 @@ class PlansController < BaseApiController # rubocop:todo Style/Documentation
 
       # GET /api/v2/plans/:id
       def show
-        raise Pundit::NotAuthorizedError unless @scopes.include?('read')
-
         @plan = Plan.includes(roles: :user).find_by(id: params[:id])
 
         raise Pundit::NotAuthorizedError unless @plan.present?
@@ -23,8 +21,6 @@ def show
 
       # GET /api/v2/plans
       def index
-        raise Pundit::NotAuthorizedError unless @scopes.include?('read')
-
         @plans = PlansPolicy::Scope.new(@resource_owner).resolve
         @plans = @plans.includes(answers: { question: :section }) if @complete
         @items = paginate_response(results: @plans)

app/controllers/api/v2/templates_controller.rb

@@ -8,8 +8,6 @@ class TemplatesController < BaseApiController
 
       # GET /api/v2/templates
       def index
-        raise Pundit::NotAuthorizedError unless @scopes.include?('read')
-
         templates = Api::V2::TemplatesPolicy::Scope.new(@resource_owner).resolve
         @items = paginate_response(results: templates)
         render '/api/v2/templates/index', status: :ok