Upstream sync

app/controllers/appearance_releases_controller.rb

@@ -78,8 +78,8 @@ class AppearanceReleasesController < ApplicationController
   end
 
   def appearance_release_params
-    params.require(:appearance_release).permit(:contract, :guardian_address, :guardian_first_name, :guardian_last_name, :guardian_phone, :guardian_photo, :guardian_email, :minor,
-                                               :person_address, :person_first_name, :person_last_name, :person_phone, :person_email, :person_photo,
+    params.require(:appearance_release).permit(:contract, :guardian_address_street1, :guardian_first_name, :guardian_last_name, :guardian_phone, :guardian_photo, :guardian_email, :minor,
+                                               :person_address_street1, :person_first_name, :person_last_name, :person_phone, :person_email, :person_photo,
                                                :applicable_medium_id, :applicable_medium_text,
                                                :territory_id, :territory_text,
                                                :term_id, :term_text, :person_date_of_birth,

app/controllers/contracts_controller.rb

@@ -48,8 +48,10 @@ class ContractsController < ApplicationController
     # Native release contracts must be generated on-the-fly; non-native releases have a contract attachment
     if releasable.native?
       send_file contract.to_pdf, download_attributes
-    else
+    elsif policy(contract).show?
       redirect_to releasable.contract.service_url
+    else
+      raise Pundit::NotAuthorizedError
     end
   end
 end

app/controllers/public/appearance_releases_controller.rb

@@ -39,11 +39,43 @@ class Public::AppearanceReleasesController < Public::BaseController
     authorize appearance_releases.build(params)
   end
 
+  def person_params
+    %i[
+      person_first_name
+      person_last_name
+      person_phone
+      person_email
+      person_photo
+      person_address_street1
+      person_address_street2
+      person_address_city
+      person_address_state
+      person_address_zip
+      person_address_country
+    ]
+  end
+
+  def guardian_params
+    %i[
+      guardian_first_name
+      guardian_last_name
+      guardian_phone
+      guardian_email
+      guardian_photo
+      guardian_address_street1
+      guardian_address_street2
+      guardian_address_city
+      guardian_address_state
+      guardian_address_zip
+      guardian_address_country
+    ]
+  end
+
   def appearance_release_params
-    params.require(:appearance_release).permit(:person_address, :person_first_name, :person_last_name, :person_phone, :person_email, :person_photo,
-                                               :guardian_address, :guardian_first_name, :guardian_last_name, :guardian_phone, :guardian_email, :guardian_photo, :minor,
-                                               :signature_base64, :person_date_of_birth,
-                                               :locale, :contract_template,)
+    params.require(:appearance_release).permit(person_params, guardian_params,
+                                               :minor, :signature_base64,
+                                               :person_date_of_birth,
+                                               :locale, :contract_template)
   end
 
   def appearance_release_params_with_locale