note_policy.rb

class NotePolicy < ApplicationPolicy
	
  # For index action
  class Scope
    attr_reader :user, :scope
    def initialize(user, scope)
      @user = user
      @scope = scope
    end

    def resolve
      scope.where(project: user.projects)
    end
  end

  attr_reader :user, :note

 	def initialize(user, note)
    @user = user
    @note = note
  end

  def show?
    ProjectPolicy.new(user, Project.find(note.project_id)).show?
  end

  def create?
    note.user == user or ProjectPolicy.new(user, Project.find(note.project_id)).show?
  end

  def update?
    note.user == user or ProjectPolicy.new(user, Project.find(note.project_id)).show?
  end

  def destroy?
  	note.user == user or ProjectPolicy.new(user, Project.find(note.project_id)).show?
  end

end

notes_controller.rb

class Api::V1::NotesController < Api::V1::BaseController

	def shared
		@notes = policy_scope(Note)
		@notes = @notes.where(query_params)
		.page(page_params[:page])
		.per(page_params[:page_size])
		authorize @notes
		render :index
	end
	
end