diff --git a/packages/xpub-faraday/config/authsome-helpers.js b/packages/xpub-faraday/config/authsome-helpers.js index 8b5a135a30aa8f7bc660d518664db6b32001017a..349e8aba0c4f809acc07e9a1e50413511ad3e10b 100644 --- a/packages/xpub-faraday/config/authsome-helpers.js +++ b/packages/xpub-faraday/config/authsome-helpers.js @@ -126,12 +126,13 @@ const hasFragmentInDraft = async ({ object, Fragment }) => { return isInDraft(fragment) } -const filterAuthorRecommendationData = recommendation => { - const { comments } = recommendation - return { - ...recommendation, - comments: comments ? comments.filter(c => c.public) : [], - } +const filterAuthorRecommendationData = (recommendations, status) => { + const canViewComments = authorAllowedStatuses.includes(status) + return recommendations.map(r => ({ + ...r, + comments: + r.comments && canViewComments ? r.comments.filter(c => c.public) : [], + })) } const stripeCollectionByRole = (coll = {}, role = '') => { @@ -151,14 +152,19 @@ const stripeCollectionByRole = (coll = {}, role = '') => { return coll } -const stripeFragmentByRole = (fragment = {}, role = '', user = {}) => { +const stripeFragmentByRole = ( + fragment = {}, + role = '', + status = '', + user = {}, +) => { const { recommendations, files, authors } = fragment switch (role) { case 'author': return { ...fragment, recommendations: recommendations - ? recommendations.map(filterAuthorRecommendationData) + ? filterAuthorRecommendationData(recommendations, status) : [], } case 'reviewer': diff --git a/packages/xpub-faraday/config/authsome-mode.js b/packages/xpub-faraday/config/authsome-mode.js index 2aada0e12aef4d742f83a5847ae150a6a58079fa..35c8382fd18971ca0dd2cab3b7375297a4eb47e5 100644 --- a/packages/xpub-faraday/config/authsome-mode.js +++ b/packages/xpub-faraday/config/authsome-mode.js @@ -132,9 +132,12 @@ async function applyAuthenticatedUserPolicy(user, operation, object, context) { if (!permission) return false + const collectionId = get(object, 'fragment.collectionId') + const { status } = await context.models.Collection.find(collectionId) + return { filter: fragment => - helpers.stripeFragmentByRole(fragment, permission.role, user), + helpers.stripeFragmentByRole(fragment, permission.role, user, status), } } diff --git a/packages/xpub-faraday/tests/authsome-helpers.test.js b/packages/xpub-faraday/tests/authsome-helpers.test.js index 8999b892b2b80a1ef5b92ffa35f8f823d84f9580..1f0823f0dc743743ef5f43954a2039374b82e9b2 100644 --- a/packages/xpub-faraday/tests/authsome-helpers.test.js +++ b/packages/xpub-faraday/tests/authsome-helpers.test.js @@ -112,6 +112,30 @@ describe('Authsome Helpers', () => { ] const result = ah.stripeFragmentByRole(fragment, 'author') const privateComments = get(result, 'recommendations[0].comments') + expect(privateComments).toHaveLength(0) + }) + it('stripeFragment - author should see comments only if recommendation has been made', () => { + const { fragment } = testFixtures.fragments + fragment.recommendations = [ + { + comments: [ + { + content: 'private', + public: false, + }, + { + content: 'public', + public: true, + }, + ], + }, + ] + const result = ah.stripeFragmentByRole( + fragment, + 'author', + 'revisionRequested', + ) + const privateComments = get(result, 'recommendations[0].comments') expect(privateComments).toHaveLength(1) }) })