Merge pull request #1521 from coralproject/perm-update

Permission Updates

graph/resolvers/comment.js

@@ -1,6 +1,14 @@
 const { property } = require('lodash');
-const { SEARCH_ACTIONS } = require('../../perms/constants');
-const { decorateWithTags, decorateWithPermissionCheck } = require('./util');
+const {
+  SEARCH_ACTIONS,
+  SEARCH_COMMENT_STATUS_HISTORY,
+  VIEW_BODY_HISTORY,
+} = require('../../perms/constants');
+const {
+  decorateWithTags,
+  decorateWithPermissionCheck,
+  checkSelfField,
+} = require('./util');
 
 const Comment = {
   hasParent({ parent_id }) {
@@ -60,9 +68,19 @@ const Comment = {
 // Decorate the Comment type resolver with a tags field.
 decorateWithTags(Comment);
 
-// Protect direct action access.
+// Protect direct action and status history access.
 decorateWithPermissionCheck(Comment, {
   actions: [SEARCH_ACTIONS],
+  status_history: [SEARCH_COMMENT_STATUS_HISTORY],
 });
 
+// Protect privileged fields.
+decorateWithPermissionCheck(
+  Comment,
+  {
+    body_history: [VIEW_BODY_HISTORY],
+  },
+  checkSelfField('author_id')
+);
+
 module.exports = Comment;

graph/typeDefs.graphql

@@ -505,8 +505,9 @@ type Comment {
   # The actual comment data.
   body: String!
 
-  # The body history of the comment.
-  body_history: [CommentBodyHistory!]!
+  # The body history of the comment. Requires the `ADMIN` or `MODERATOR` role or
+  # the author.
+  body_history: [CommentBodyHistory!]
 
   # The tags on the comment
   tags: [TagLink!]

perms/constants/query.js

@@ -10,4 +10,5 @@ module.exports = {
   LIST_OWN_TOKENS: 'LIST_OWN_TOKENS',
   VIEW_USER_ROLE: 'VIEW_USER_ROLE',
   VIEW_USER_EMAIL: 'VIEW_USER_EMAIL',
+  VIEW_BODY_HISTORY: 'VIEW_BODY_HISTORY',
 };

perms/reducers/query.js

@@ -13,6 +13,7 @@ module.exports = (user, perm) => {
     case types.VIEW_PROTECTED_SETTINGS:
     case types.VIEW_USER_ROLE:
     case types.VIEW_USER_EMAIL:
+    case types.VIEW_BODY_HISTORY:
       return check(user, ['ADMIN', 'MODERATOR']);
     case types.LIST_OWN_TOKENS:
       return check(user, ['ADMIN']);