editComment only allows editing real comments authored by the requesting user

graph/mutators/comment.js

@@ -230,6 +230,15 @@ const removeCommentTag = ({user, loaders: {Comments}}, {id, tag}) => {
 const editComment = async ({user, loaders: {Comments}}, {id, edit}) => {
   const {body} = edit;
   const comment = await CommentsService.findById(id);
+  if ( ! comment) {
+    throw new errors.APIError('Comment not found', {
+      status: 404,
+      translation_key: 'NOT_FOUND',
+    });
+  }
+  if ( ! (user && user.id && (user.id === comment.author_id))) {
+    throw errors.ErrNotAuthorized;
+  }
   const {asset_id} = comment;
   const determineStatusForComment = async ({body, asset_id}) => {
     const [wordlist, settings] = await filterNewComment({asset_id, body});

test/server/graph/mutations/editComment.js

@@ -73,6 +73,45 @@ describe('graph.mutations.editComment', () => {
     expect(commentAfterEdit.status).to.equal('NONE');
   });
 
+  it('A user can\'t edit someone else\'s comment', async () => {
+    const comment = await CommentsService.publicCreate({
+      asset_id: asset.id,
+      author_id: user.id,
+      body: `hello there! ${  String(Math.random()).slice(2)}`,
+    });
+
+    const userB = await UsersService.createLocalUser(
+      'usernameB@example.com', 'password', 'usernameB');
+    const newBody = 'This body should never be set';
+    const context = new Context({user: userB});
+    const response = await graphql(schema, editCommentMutation, {}, context, {
+      id: comment.id,
+      edit: {
+        body: newBody
+      }
+    });
+    expect(response.errors).to.be.empty;
+    expect(response.data.editComment.errors[0].translation_key).to.equal('NOT_AUTHORIZED');
+    const commentAfterEdit = await CommentsService.findById(comment.id);    
+
+    // it *hasn't* changed from the original
+    expect(commentAfterEdit.body).to.equal(comment.body);
+  });
+
+  it('A user Can\'t edit a comment id that doesn\'t exist', async () => {
+    const fakeCommentId = 'nooooope';
+    const newBody = 'This body should never be set';
+    const context = new Context({user});
+    const response = await graphql(schema, editCommentMutation, {}, context, {
+      id: fakeCommentId,
+      edit: {
+        body: newBody
+      }
+    });
+    expect(response.errors).to.be.empty;
+    expect(response.data.editComment.errors[0].translation_key).to.equal('NOT_FOUND');
+  });
+
   const bannedWord = 'BANNED_WORD';
   [
     {
@@ -175,16 +214,8 @@ describe('graph.mutations.editComment', () => {
     });
   });
 
-  /**
-  Server: When an Edit is sent to the server
-  -- The (old) comment.body and (current) timestamp are pushed onto the comment.body_history array.
-  -- The status is set to the same status as if the comment is posted for the first time.*
-  -- The body of the comment is updated.
-  */
   // user can't edit outside of edit window
-  // can't edit comment id that doesn't exist
-  // user cant edit comments by others
 
   // should BANNED users be able to edit their comments?
-
+  
 });