Reactions: Return 404 when status should not be visible, asynchronous unreact

app/controllers/api/v1/statuses/reactions_controller.rb

@@ -5,21 +5,35 @@ class Api::V1::Statuses::ReactionsController < Api::BaseController
 
   before_action -> { doorkeeper_authorize! :write, :'write:favourites' }
   before_action :require_user!
-  before_action :set_status
+  before_action :set_status, only: [:create]
 
   def create
     ReactService.new.call(current_account, @status, params[:id])
-    render_empty
+    render json: @status, serializer: REST::StatusSerializer
   end
 
   def destroy
-    UnreactService.new.call(current_account, @status, params[:id])
-    render_empty
+    react = current_account.status_reactions.find_by(status_id: params[:status_id], name: params[:id])
+
+    if react
+      @status = react.status
+      UnreactWorker.perform_async(current_account.id, @status.id, params[:id])
+    else
+      @status = Status.find(params[:status_id])
+      authorize @status, :show?
+    end
+
+    render json: @status, serializer: REST::StatusSerializer, relationships: StatusRelationshipsPresenter.new([@status], current_account.id, reactions_map: { @status.id => false })
+  rescue Mastodon::NotPermittedError
+    not_found
   end
 
   private
 
   def set_status
     @status = Status.find(params[:status_id])
+    authorize @status, :show?
+  rescue Mastodon::NotPermittedError
+    not_found
   end
 end

app/models/concerns/account_associations.rb

@@ -13,6 +13,7 @@ module AccountAssociations
     # Timelines
     has_many :statuses, inverse_of: :account, dependent: :destroy
     has_many :favourites, inverse_of: :account, dependent: :destroy
+    has_many :status_reactions, inverse_of: :account, dependent: :destroy
     has_many :bookmarks, inverse_of: :account, dependent: :destroy
     has_many :mentions, inverse_of: :account, dependent: :destroy
     has_many :notifications, inverse_of: :account, dependent: :destroy

app/workers/unreact_worker.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+class UnreactWorker
+  include Sidekiq::Worker
+
+  def perform(account_id, status_id, emoji)
+    UnreactService.new.call(Account.find(account_id), Status.find(status_id), emoji)
+  rescue ActiveRecord::RecordNotFound
+    true
+  end
+end