From b51bb7486ebdcf11e6666a27cec1328ad0874247 Mon Sep 17 00:00:00 2001
From: Wyatt Johnson <wyattjoh@gmail.com>
Date: Wed, 11 Apr 2018 15:56:03 -0600
Subject: [PATCH 1/2] Permission Updates

- Restrict status history to ADMIN/MODERATORS
- Restrict body history to ADMIN/MODERATORS
---
 graph/resolvers/comment.js | 22 ++++++++++++++++++++--
 graph/typeDefs.graphql     |  5 +++--
 perms/constants/query.js   |  1 +
 perms/reducers/query.js    |  1 +
 4 files changed, 25 insertions(+), 4 deletions(-)

diff --git a/graph/resolvers/comment.js b/graph/resolvers/comment.js
index 7005701ec..7fff6a1ea 100644
--- a/graph/resolvers/comment.js
+++ b/graph/resolvers/comment.js
@@ -1,6 +1,14 @@
 const { property } = require('lodash');
-const { SEARCH_ACTIONS } = require('../../perms/constants');
-const { decorateWithTags, decorateWithPermissionCheck } = require('./util');
+const {
+  SEARCH_ACTIONS,
+  SEARCH_COMMENT_STATUS_HISTORY,
+  VIEW_BODY_HISTORY,
+} = require('../../perms/constants');
+const {
+  decorateWithTags,
+  decorateWithPermissionCheck,
+  checkSelfField,
+} = require('./util');
 
 const Comment = {
   hasParent({ parent_id }) {
@@ -65,4 +73,14 @@ decorateWithPermissionCheck(Comment, {
   actions: [SEARCH_ACTIONS],
 });
 
+// Protect privileged fields.
+decorateWithPermissionCheck(
+  Comment,
+  {
+    status_history: [SEARCH_COMMENT_STATUS_HISTORY],
+    body_history: [VIEW_BODY_HISTORY],
+  },
+  checkSelfField('author_id')
+);
+
 module.exports = Comment;
diff --git a/graph/typeDefs.graphql b/graph/typeDefs.graphql
index 2414faf1f..c1e7b9ecb 100644
--- a/graph/typeDefs.graphql
+++ b/graph/typeDefs.graphql
@@ -505,8 +505,9 @@ type Comment {
   # The actual comment data.
   body: String!
 
-  # The body history of the comment.
-  body_history: [CommentBodyHistory!]!
+  # The body history of the comment. Requires the `ADMIN` or `MODERATOR` role or
+  # the author.
+  body_history: [CommentBodyHistory!]
 
   # The tags on the comment
   tags: [TagLink!]
diff --git a/perms/constants/query.js b/perms/constants/query.js
index b846b15ce..197c5d9f9 100644
--- a/perms/constants/query.js
+++ b/perms/constants/query.js
@@ -10,4 +10,5 @@ module.exports = {
   LIST_OWN_TOKENS: 'LIST_OWN_TOKENS',
   VIEW_USER_ROLE: 'VIEW_USER_ROLE',
   VIEW_USER_EMAIL: 'VIEW_USER_EMAIL',
+  VIEW_BODY_HISTORY: 'VIEW_BODY_HISTORY',
 };
diff --git a/perms/reducers/query.js b/perms/reducers/query.js
index 0852d8e2b..ed507139d 100644
--- a/perms/reducers/query.js
+++ b/perms/reducers/query.js
@@ -13,6 +13,7 @@ module.exports = (user, perm) => {
     case types.VIEW_PROTECTED_SETTINGS:
     case types.VIEW_USER_ROLE:
     case types.VIEW_USER_EMAIL:
+    case types.VIEW_BODY_HISTORY:
       return check(user, ['ADMIN', 'MODERATOR']);
     case types.LIST_OWN_TOKENS:
       return check(user, ['ADMIN']);

From dc0c3b4a676072083eb1a202197e3b3ae9602e56 Mon Sep 17 00:00:00 2001
From: Wyatt Johnson <wyattjoh@gmail.com>
Date: Wed, 11 Apr 2018 15:58:04 -0600
Subject: [PATCH 2/2] Authors cannot see their own status history

---
 graph/resolvers/comment.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/graph/resolvers/comment.js b/graph/resolvers/comment.js
index 7fff6a1ea..b174dd5ae 100644
--- a/graph/resolvers/comment.js
+++ b/graph/resolvers/comment.js
@@ -68,16 +68,16 @@ const Comment = {
 // Decorate the Comment type resolver with a tags field.
 decorateWithTags(Comment);
 
-// Protect direct action access.
+// Protect direct action and status history access.
 decorateWithPermissionCheck(Comment, {
   actions: [SEARCH_ACTIONS],
+  status_history: [SEARCH_COMMENT_STATUS_HISTORY],
 });
 
 // Protect privileged fields.
 decorateWithPermissionCheck(
   Comment,
   {
-    status_history: [SEARCH_COMMENT_STATUS_HISTORY],
     body_history: [VIEW_BODY_HISTORY],
   },
   checkSelfField('author_id')