Correctly authorize comment deletion

app/controllers/comments_controller.rb

@@ -111,9 +111,8 @@ class CommentsController < ApplicationController
   end
 
   def destroy
-    @comments = Comment.where(file_id: params[:file_id], row: params[:row])
-    authorize!
-    @comments.delete_all
+    @comments = Comment.where(file_id: params[:file_id], row: params[:row], user: current_user)
+    @comments.each { |comment| authorize comment; comment.destroy }
     respond_to do |format|
       #format.html { redirect_to comments_url, notice: 'Comments were successfully destroyed.' }
       format.html { head :no_content, notice: 'Comments were successfully destroyed.' }

app/policies/comment_policy.rb

@@ -1,12 +1,6 @@
 class CommentPolicy < ApplicationPolicy
   def author?
-    if @record.is_a?(ActiveRecord::Relation)
-      flag = true
-      @record.all {|item| flag = (flag and item.author == @user)}
-      flag
-    else
-      @user == @record.author
-    end
+    @user == @record.author
   end
   private :author?