Use policies to determine if attributes can be set in the API

This is more idiomatic than checking membership explicitly.

2 files changed, 3 insertions, 9 deletions

diff --git a/lib/api/helpers/notes_helpers.rb b/lib/api/helpers/notes_helpers.rb
index 7885e3fa1e1..7b1f5c2584b 100644
--- a/lib/api/helpers/notes_helpers.rb
+++ b/lib/api/helpers/notes_helpers.rb
@@ -92,10 +92,7 @@ module API
 
         parent = noteable_parent(noteable)
 
-        if opts[:created_at]
-          opts.delete(:created_at) unless
-            (current_user.admin? || user_project.owner == current_user || current_user.owned_groups.include?(user_project.owner))
-        end
+        opts.delete(:created_at) unless current_user.can?(:set_note_created_at, policy_object)
 
         opts[:updated_at] = opts[:created_at] if opts[:created_at]
 
diff --git a/lib/api/issues.rb b/lib/api/issues.rb
index 2d2250acaa2..cedfd2fbaa0 100644
--- a/lib/api/issues.rb
+++ b/lib/api/issues.rb
@@ -172,11 +172,8 @@ module API
 
         authorize! :create_issue, user_project
 
-        # Setting created_at time or iid only allowed for admins and project owners
-        unless current_user.admin? || user_project.owner == current_user || current_user.owned_groups.include?(user_project.owner)
-          params.delete(:created_at)
-          params.delete(:iid)
-        end
+        params.delete(:created_at) unless current_user.can?(:set_issue_created_at, user_project)
+        params.delete(:iid) unless current_user.can?(:set_issue_iid, user_project)
 
         issue_params = declared_params(include_missing: false)