Add missing authorization to ReactService

app/policies/status_policy.rb

@@ -28,6 +28,10 @@ class StatusPolicy < ApplicationPolicy
     show? && !blocking_author?
   end
 
+  def react?
+    show? && !blocking_author?
+  end
+
   def destroy?
     owned?
   end

app/services/react_service.rb

@@ -5,6 +5,8 @@ class ReactService < BaseService
   include Payloadable
 
   def call(account, status, emoji)
+    authorize_with account, status, :react?
+
     name, domain = emoji.split('@')
     custom_emoji = CustomEmoji.find_by(shortcode: name, domain: domain)
     reaction = StatusReaction.find_by(account: account, status: status, name: name, custom_emoji: custom_emoji)