Add authorization to API watchers#create

lib/api/v3/work_packages/watchers_api.rb

@@ -8,13 +8,17 @@ module API
             requires :user_id, desc: 'Id of the user watching the work package'
           end
 
+          before do
+            @user = User.find params[:user_id]
+          end
+
           post do
-            user = User.find params[:user_id]
+            authorize(:add_work_package_watchers, context: @work_package.project)
 
-            if @work_package.watcher_users.include?(user)
+            if @work_package.watcher_users.include?(@user)
               status 200
             else
-              watcher = Watcher.new(user: user, watchable: @work_package)
+              watcher = Watcher.new(user: @user, watchable: @work_package)
 
               if watcher.valid?
                 @work_package.watchers << watcher
@@ -23,7 +27,7 @@ module API
               end
             end
 
-            model = ::API::V3::Users::UserModel.new(user)
+            model = ::API::V3::Users::UserModel.new(@user)
             @representer = ::API::V3::Users::UserRepresenter.new(model).to_json
           end