First draft of Collection update API (#37110)

app/controllers/api/v1_alpha/collections_controller.rb

@@ -1,6 +1,8 @@
 # frozen_string_literal: true
 
 class Api::V1Alpha::CollectionsController < Api::BaseController
+  include Authorization
+
   rescue_from ActiveRecord::RecordInvalid, Mastodon::ValidationError do |e|
     render json: { error: ValidationErrorFormatter.new(e).as_json }, status: 422
   end
@@ -11,23 +13,41 @@ class Api::V1Alpha::CollectionsController < Api::BaseController
 
   before_action :require_user!, only: [:create]
 
+  after_action :verify_authorized
+
   def show
     cache_if_unauthenticated!
     @collection = Collection.find(params[:id])
+    authorize @collection, :show?
 
     render json: @collection, serializer: REST::CollectionSerializer
   end
 
   def create
-    @collection = CreateCollectionService.new.call(collection_params, current_user.account)
+    authorize Collection, :create?
+
+    @collection = CreateCollectionService.new.call(collection_creation_params, current_user.account)
+
+    render json: @collection, serializer: REST::CollectionSerializer
+  end
+
+  def update
+    @collection = Collection.find(params[:id])
+    authorize @collection, :update?
+
+    @collection.update!(collection_update_params) # TODO: Create a service for this to federate changes
 
     render json: @collection, serializer: REST::CollectionSerializer
   end
 
   private
 
-  def collection_params
-    params.permit(:name, :description, :sensitive, :discoverable, :tag, account_ids: [])
+  def collection_creation_params
+    params.permit(:name, :description, :sensitive, :discoverable, :tag_name, account_ids: [])
+  end
+
+  def collection_update_params
+    params.permit(:name, :description, :sensitive, :discoverable, :tag_name)
   end
 
   def check_feature_enabled