From 756b5f8b457da8bb56a145500c4d8f1742684c6d Mon Sep 17 00:00:00 2001
From: Benjamin Goering <bengoering@gmail.com>
Date: Tue, 2 May 2017 16:09:09 -0500
Subject: [PATCH] editComment only allows editing real comments authored by the
 requesting user

---
 graph/mutators/comment.js                  |  9 ++++
 test/server/graph/mutations/editComment.js | 49 ++++++++++++++++++----
 2 files changed, 49 insertions(+), 9 deletions(-)

diff --git a/graph/mutators/comment.js b/graph/mutators/comment.js
index cf5382d4f..5c4377435 100644
--- a/graph/mutators/comment.js
+++ b/graph/mutators/comment.js
@@ -230,6 +230,15 @@ const removeCommentTag = ({user, loaders: {Comments}}, {id, tag}) => {
 const editComment = async ({user, loaders: {Comments}}, {id, edit}) => {
   const {body} = edit;
   const comment = await CommentsService.findById(id);
+  if ( ! comment) {
+    throw new errors.APIError('Comment not found', {
+      status: 404,
+      translation_key: 'NOT_FOUND',
+    });
+  }
+  if ( ! (user && user.id && (user.id === comment.author_id))) {
+    throw errors.ErrNotAuthorized;
+  }
   const {asset_id} = comment;
   const determineStatusForComment = async ({body, asset_id}) => {
     const [wordlist, settings] = await filterNewComment({asset_id, body});
diff --git a/test/server/graph/mutations/editComment.js b/test/server/graph/mutations/editComment.js
index 55a386da6..de2944069 100644
--- a/test/server/graph/mutations/editComment.js
+++ b/test/server/graph/mutations/editComment.js
@@ -73,6 +73,45 @@ describe('graph.mutations.editComment', () => {
     expect(commentAfterEdit.status).to.equal('NONE');
   });
 
+  it('A user can\'t edit someone else\'s comment', async () => {
+    const comment = await CommentsService.publicCreate({
+      asset_id: asset.id,
+      author_id: user.id,
+      body: `hello there! ${  String(Math.random()).slice(2)}`,
+    });
+
+    const userB = await UsersService.createLocalUser(
+      'usernameB@example.com', 'password', 'usernameB');
+    const newBody = 'This body should never be set';
+    const context = new Context({user: userB});
+    const response = await graphql(schema, editCommentMutation, {}, context, {
+      id: comment.id,
+      edit: {
+        body: newBody
+      }
+    });
+    expect(response.errors).to.be.empty;
+    expect(response.data.editComment.errors[0].translation_key).to.equal('NOT_AUTHORIZED');
+    const commentAfterEdit = await CommentsService.findById(comment.id);    
+
+    // it *hasn't* changed from the original
+    expect(commentAfterEdit.body).to.equal(comment.body);
+  });
+
+  it('A user Can\'t edit a comment id that doesn\'t exist', async () => {
+    const fakeCommentId = 'nooooope';
+    const newBody = 'This body should never be set';
+    const context = new Context({user});
+    const response = await graphql(schema, editCommentMutation, {}, context, {
+      id: fakeCommentId,
+      edit: {
+        body: newBody
+      }
+    });
+    expect(response.errors).to.be.empty;
+    expect(response.data.editComment.errors[0].translation_key).to.equal('NOT_FOUND');
+  });
+
   const bannedWord = 'BANNED_WORD';
   [
     {
@@ -175,16 +214,8 @@ describe('graph.mutations.editComment', () => {
     });
   });
 
-  /**
-  Server: When an Edit is sent to the server
-  -- The (old) comment.body and (current) timestamp are pushed onto the comment.body_history array.
-  -- The status is set to the same status as if the comment is posted for the first time.*
-  -- The body of the comment is updated.
-  */
   // user can't edit outside of edit window
-  // can't edit comment id that doesn't exist
-  // user cant edit comments by others
 
   // should BANNED users be able to edit their comments?
-
+  
 });