Adjusting based on PR feedback, added public filter to settings object

models/action.js

@@ -1,5 +1,6 @@
 const mongoose = require('../mongoose');
 const uuid = require('uuid');
+const _ = require('lodash');
 const Schema = mongoose.Schema;
 
 const ActionSchema = new Schema({
@@ -66,6 +67,34 @@ ActionSchema.statics.findByItemIdArray = function(item_ids) {
   });
 };
 
+/**
+ * Fetches the action summaries for the given asset, and comments around the
+ * given user id.
+ * @param  {[type]} asset_id             [description]
+ * @param  {[type]} comments             [description]
+ * @param  {String} [current_user_id=''] [description]
+ * @return {[type]}                      [description]
+ */
+ActionSchema.statics.getActionSummariesFromComments = (asset_id = '', comments, current_user_id = '') => {
+
+  // Get the user id's from the author id's as a unique array that gets
+  // sorted.
+  let userIDs = _.uniq(comments.map((comment) => comment.author_id)).sort();
+
+  // Fetch the actions for pretty much everything at this point.
+  return Action.getActionSummaries(_.uniq([
+
+    // Actions can be on assets...
+    asset_id,
+
+    // Comments...
+    ...comments.map((comment) => comment.id),
+
+    // Or Authors...
+    ...userIDs
+  ].filter((e) => e)), current_user_id);
+};
+
 /**
  * Returns summaries of actions for an array of ids
  * @param {String} ids array of user identifiers (uuid)

models/setting.js

@@ -1,5 +1,6 @@
 const mongoose = require('../mongoose');
 const Schema = mongoose.Schema;
+const _ = require('lodash');
 const cache = require('../cache');
 
 /**
@@ -82,6 +83,14 @@ SettingService.update = (settings) => Setting.findOneAndUpdate(selector, {
     .then(() => settings);
 });
 
+/**
+ * Filters the document to ensure that the resulting document is indeed ready
+ * for non authenticated users.
+ * @param  {Object} settings the source settings object
+ * @return {Object}          the filtered settings object
+ */
+SettingService.public = (settings) => _.pick(settings, ['moderation', 'infoBoxEnable', 'infoBoxContent']);
+
 /**
  * This is run once when the app starts to ensure settings are populated.
  * @return {Promise} null initialize the global settings object

routes/api/comments/index.js

@@ -48,10 +48,7 @@ router.get('/', authorization.needed('admin'), (req, res, next) => {
     return Promise.all([
       comments,
       User.findByIdArray(_.uniq(comments.map((comment) => comment.author_id))),
-      Action.getActionSummaries(_.uniq([
-        ...comments.map((comment) => comment.id),
-        ...comments.map((comment) => comment.author_id)
-      ]))
+      Action.getActionSummariesFromComments(asset_id, comments, req.user ? req.user.id : false)
     ]);
   })
   .then(([comments, users, actions])=>

routes/api/stream/index.js

@@ -33,7 +33,7 @@ router.get('/', (req, res, next) => {
 
     // Merge the asset specific settings with the returned settings object in
     // the event that the asset that was returned also had settings.
-    if (asset.settings) {
+    if (asset && asset.settings) {
       settings = Object.assign({}, settings, asset.settings);
     }
 
@@ -70,17 +70,7 @@ router.get('/', (req, res, next) => {
     let users = userIDs.length > 0 ? User.findByIdArray(userIDs) : [];
 
     // Fetch the actions for pretty much everything at this point.
-    let actions = Action.getActionSummaries(_.uniq([
-
-      // Actions can be on assets...
-      asset.id,
-
-      // Comments...
-      ...comments.map((comment) => comment.id),
-
-      // Or Authors...
-      ...userIDs
-    ]), req.user ? req.user.id : false);
+    let actions = Action.getActionSummariesFromComments(asset.id, comments, req.user ? req.user.id : false);
 
     return Promise.all([
 
@@ -108,7 +98,7 @@ router.get('/', (req, res, next) => {
       comments,
       users,
       actions,
-      settings
+      settings: Setting.public(settings)
     });
   })
   .catch(error => {