Add require_owner! filter action

app/controllers/application_controller.rb

@@ -10,4 +10,18 @@ class ApplicationController < ActionController::API
   def configure_permitted_parameters
     devise_parameter_sanitizer.permit(:sign_up, keys: [:username])
   end
+
+  private
+
+  def require_owner! owner
+    render_forbidden_error if owner != current_user
+  end
+
+  def render_forbidden_error
+    render json: {
+      errors: [
+        'Only the parent tournament owner can update this resource'
+      ]
+    }, status: :forbidden
+  end
 end