From ad0f530fd3c68b7b8d53b02c68575f5394494c3e Mon Sep 17 00:00:00 2001
From: Riley Davis <riley.davis@gmail.com>
Date: Thu, 12 Jan 2017 17:07:35 -0700
Subject: [PATCH] don't return unpublished comments in My Comments section. add
 tests

---
 models/comment.js                  | 12 ++++++++++--
 routes/api/comments/index.js       |  2 +-
 tests/models/comment.js            | 17 +++++++++++++++++
 tests/routes/api/comments/index.js |  5 ++---
 4 files changed, 30 insertions(+), 6 deletions(-)

diff --git a/models/comment.js b/models/comment.js
index 9bd9163c4..d99cbed06 100644
--- a/models/comment.js
+++ b/models/comment.js
@@ -282,8 +282,16 @@ CommentSchema.statics.all = () => Comment.find();
  * probably to be paginated at some point in the future
  * @return {Promise} array resolves to an array of comments by that user
  */
-CommentSchema.statics.findByUserId = function (author_id) {
-  return Comment.find({author_id});
+CommentSchema.statics.findByUserId = function (author_id, admin = false) {
+
+  // do not return un-published comments for non-admins
+  let query = {author_id};
+
+  if (!admin) {
+    query.$nor = [{status: 'premod'}, {status: 'rejected'}];
+  }
+
+  return Comment.find(query);
 };
 
 // Comment model.
diff --git a/routes/api/comments/index.js b/routes/api/comments/index.js
index 8bf3616eb..1d5d73ea0 100644
--- a/routes/api/comments/index.js
+++ b/routes/api/comments/index.js
@@ -48,7 +48,7 @@ router.get('/', (req, res, next) => {
   // otherwise this will be a vulnerability if you pass user_id and something else,
   // the app will return admin-level data without the proper checks
   if (user_id) {
-    query = Comment.findByUserId(user_id);
+    query = Comment.findByUserId(user_id, authorization.has(req.user, 'admin'));
   } else if (status) {
     query = assetIDWrap(Comment.findByStatus(status === 'new' ? null : status));
   } else if (action_type) {
diff --git a/tests/models/comment.js b/tests/models/comment.js
index 20590dc3d..419fb4d79 100644
--- a/tests/models/comment.js
+++ b/tests/models/comment.js
@@ -209,6 +209,23 @@ describe('models.Comment', () => {
     });
   });
 
+  describe('#findByUserId', () => {
+    it('should return all comments if admin', () => {
+      return Comment.findByUserId('456', true)
+        .then(comments => {
+          expect(comments).to.have.length(4);
+        });
+    });
+
+    it('should not return premod and rejected comments if not admin', () => {
+      return Comment.findByUserId('456')
+        .then(comments => {
+          expect(comments).to.have.length(1);
+        });
+    });
+
+  });
+
   describe('#changeStatus', () => {
 
     it('should change the status of a comment from no status', () => {
diff --git a/tests/routes/api/comments/index.js b/tests/routes/api/comments/index.js
index 5edb52099..ed1f3d22f 100644
--- a/tests/routes/api/comments/index.js
+++ b/tests/routes/api/comments/index.js
@@ -83,15 +83,14 @@ describe('/api/v1/comments', () => {
       ]);
     });
 
-    it('should return only the owner’s comments if the user is not an admin', () => {
+    it('should return only the owner’s published comments if the user is not an admin', () => {
       return chai.request(app)
         .get('/api/v1/comments?user_id=456')
         .set(passport.inject({id: '456', roles: []}))
         .then(res => {
           expect(res).to.have.status(200);
-          expect(res.body.comments).to.have.length(2);
+          expect(res.body.comments).to.have.length(1);
           expect(res.body.comments[0]).to.have.property('author_id', '456');
-          expect(res.body.comments[1]).to.have.property('author_id', '456');
         });
     });