[B] Ensure engage_publicly ability is false for unestablished users

ManifoldScholar · Jan 23, 2025 · d3451ea · d3451ea
1 parent d472d7b
commit d3451ea
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/api/app/authorizers/project_authorizer.rb b/api/app/authorizers/project_authorizer.rb
@@ -98,7 +98,8 @@ def drafts_readable_by?(user, _options = {})
     has_any_role? user, *RoleName.draft_access
   end
 
-  def publicly_engageable_by?(_user, _options = {})
+  def publicly_engageable_by?(user, _options = {})
+    return false unless user&.trusted? || user&.established?
     !resource.disable_engagement? && !Settings.instance.general[:disable_engagement]
   end