competition certificate

app/controllers/competitions/prizes_controller.rb

@@ -1,8 +1,10 @@
 class Competitions::PrizesController < Competitions::BaseController
   before_action :require_prize_user!
 
+  helper_method :current_prize_user
+
   def show
-    self_prizes = current_competition.competition_prize_users.where(user_id: current_user.id).includes(:competition_team).order(:competition_prize_id)
+    self_prizes = current_competition.competition_prize_users.where(user_id: current_prize_user.id).includes(:competition_team).order(:competition_prize_id)
 
     @leader = self_prizes.any?{ |prize_user| prize_user.leader? && prize_user.competition_prize.category == 'bonus' } # 是否为队长并且有奖金奖励
     if @leader
@@ -22,8 +24,13 @@ class Competitions::PrizesController < Competitions::BaseController
   private
 
   def require_prize_user!
-    return if current_competition.competition_prize_users.exists?(user: current_user)
+    return if current_competition.competition_prize_users.exists?(user: current_prize_user)
+    return if current_user.admin_or_business? || current_user.id == current_prize_user.id
 
     render_forbidden
   end
+
+  def current_prize_user
+    @_current_prize_user ||= User.find(params[:user_id])
+  end
 end

app/views/competitions/prizes/show.json.jbuilder

@@ -5,7 +5,7 @@ if @leader
   json.bank_account_editable @bank_account_editable
 end
 
-json.all_certified current_user.all_certified?
+json.all_certified current_prize_user.all_certified?
 json.personal_certifications do
   json.array! @self_prizes do |prize_user|
     json.url personal_competition_certificate_path(current_competition.identifier, prize_user)