3 files changed, 11 insertions, 7 deletions
diff --git a/modules/tag/helpers/tag_item_rest.php b/modules/tag/helpers/tag_item_rest.php
index 60d37437..672cec53 100644
--- a/modules/tag/helpers/tag_item_rest.php
+++ b/modules/tag/helpers/tag_item_rest.php
@@ -23,8 +23,8 @@ class tag_item_rest_Core {
     return array(
       "url" => $request->url,
       "members" => array(
-        rest::url("tag", $tag),
-        rest::url("item", $item)));
+        "tag" => rest::url("tag", $tag),
+        "item" => rest::url("item", $item)));
   }
 
   static function delete($request) {
@@ -37,7 +37,7 @@ class tag_item_rest_Core {
     list ($tag_id, $item_id) = split(",", $tuple);
     $tag = ORM::factory("tag", $tag_id);
     $item = ORM::factory("item", $item_id);
-    if (!$tag->loaded() || !$item->loaded() || !$tag->has($item)) {
+    if (!$tag->loaded() || !$item->loaded() || !$tag->has($item) || !access::can("view", $item)) {
       throw new Kohana_404_Exception();
     }
 
diff --git a/modules/tag/helpers/tag_items_rest.php b/modules/tag/helpers/tag_items_rest.php
index ef563ac6..18973ebb 100644
--- a/modules/tag/helpers/tag_items_rest.php
+++ b/modules/tag/helpers/tag_items_rest.php
@@ -37,12 +37,16 @@ class tag_items_rest_Core {
     $item = rest::resolve($request->params->item);
     access::required("view", $item);
 
+    if (!$tag->loaded()) {
+      throw new Kohana_404_Exception();
+    }
+
     tag::add($item, $tag->name);
     return array(
       "url" => rest::url("tag_item", $tag, $item),
       "members" => array(
-        rest::url("tag", $tag),
-        rest::url("item", $item)));
+        "tag" => rest::url("tag", $tag),
+        "item" => rest::url("item", $item)));
   }
 
   static function delete($request) {
diff --git a/modules/tag/tests/Tag_Item_Rest_Helper_Test.php b/modules/tag/tests/Tag_Item_Rest_Helper_Test.php
index 6c49ad67..69c580f1 100644
--- a/modules/tag/tests/Tag_Item_Rest_Helper_Test.php
+++ b/modules/tag/tests/Tag_Item_Rest_Helper_Test.php
@@ -32,8 +32,8 @@ class Tag_Item_Rest_Helper_Test extends Gallery_Unit_Test_Case {
     $this->assert_equal_array(
       array("url" => rest::url("tag_item", $tag, item::root()),
             "members" => array(
-              rest::url("tag", $tag),
-              rest::url("item", item::root()))),
+              "tag" => rest::url("tag", $tag),
+              "item" => rest::url("item", item::root()))),
       tag_item_rest::get($request));
   }