Draft of the task list api controller

app/controllers/api/v1/task_lists_controller.rb

@@ -0,0 +1,28 @@
+class Api::V1::TaskListsController < Api::V1::BaseController
+  CANNOT_MANAGE = "You do not have permission to manage this task list."
+  NOT_FOUND = "The task list could not be found."
+
+  before_filter :get_task_list
+  before_filter :check_task_list_permission, except: :show
+
+  def show
+  end
+
+  def edit
+    #@task_list.update_attributes(params)
+  end
+
+  private
+    def get_task_list
+      @task_list = TaskList.find(params[:id])
+      if @task_list.nil?
+        render json: { errors: [NOT_FOUND] }, status: 404 and return
+      end
+    end
+
+    def check_task_list_permission
+      if cannot? :manage, Bike and @task_list.item != current_user.bike
+        render json: { errors: [CANNOT_MANAGE]}, status: 403 and return
+      end
+    end
+end

app/views/api/v1/task_lists/show.json.jbuilder

@@ -0,0 +1,15 @@
+json.task_lists [@task_list] do |tl|
+  json.array! tl
+  json.links do
+    json.bike do
+      json.href api_bike_path(tl.item)
+      json.id tl.item_id
+    end
+    json.tasks tl.tasks do |task|
+      json.id task.id
+      json.done task.done
+      json.notes task.notes
+      json.task task.task
+    end
+  end
+end

config/routes.rb

@@ -20,6 +20,8 @@ Velocipede::Application.routes.draw do
 
       get  'bikes/:id'    => "bikes#show",   as: "api_bike"
       post 'bikes/create' => "bikes#create", as: "api_create_bike"
+
+      get  'task_lists/:id' => "task_lists#show", as: "api_task_list"
     end
   end