2429d6c961
* Let the user see their own username when viewing their own deleted comments. * Don't hide the creator_id field from the comment creator in the API. * Hide the score, do_not_bump_post, and is_sticky fields for deleted comments in the HTML and in the API, unless the user is a moderator. * Hide the "..." popup menu on deleted comments, unless the user is a moderator. This is so that when a user looks at their own comment history, their name isn't hidden from them on their own deleted comments. This may confuse users however into thinking their name is still visible to other users.
60 lines
1.5 KiB
Ruby
60 lines
1.5 KiB
Ruby
# frozen_string_literal: true
|
|
|
|
class CommentPolicy < ApplicationPolicy
|
|
def create?
|
|
unbanned?
|
|
end
|
|
|
|
def update?
|
|
unbanned? && (user.is_moderator? || (record.updater_id == user.id && !record.is_deleted?))
|
|
end
|
|
|
|
def reportable?
|
|
unbanned? && record.creator_id != user.id && !record.creator.is_moderator? && !record.is_deleted? && record.created_at.after?(1.year.ago)
|
|
end
|
|
|
|
def can_sticky_comment?
|
|
user.is_moderator?
|
|
end
|
|
|
|
def can_see_deleted?
|
|
user.is_moderator?
|
|
end
|
|
|
|
def can_see_creator?
|
|
!record.is_deleted? || can_see_deleted? || record.creator_id == user.id
|
|
end
|
|
|
|
def reply?
|
|
!record.is_deleted?
|
|
end
|
|
|
|
def permitted_attributes_for_create
|
|
[:body, :post_id, :do_not_bump_post, (:is_sticky if can_sticky_comment?)].compact
|
|
end
|
|
|
|
def permitted_attributes_for_update
|
|
[:body, :is_deleted, (:is_sticky if can_sticky_comment?)].compact
|
|
end
|
|
|
|
def api_attributes
|
|
attributes = super
|
|
attributes -= [:creator_id] unless can_see_creator?
|
|
attributes -= [:updater_id, :body, :score, :do_not_bump_post, :is_sticky] if record.is_deleted? && !can_see_deleted?
|
|
attributes
|
|
end
|
|
|
|
def visible_for_search(comments, attribute)
|
|
case attribute
|
|
in :creator | :creator_id if !can_see_deleted?
|
|
comments.where(creator: user, is_deleted: true).or(comments.undeleted)
|
|
in :updater | :updater_id | :body | :score | :do_not_bump_post | :is_sticky if !can_see_deleted?
|
|
comments.undeleted
|
|
else
|
|
comments
|
|
end
|
|
end
|
|
|
|
alias_method :undelete?, :update?
|
|
end
|