From 985fc05a47f73521af3f89750c85e0d23f5996c9 Mon Sep 17 00:00:00 2001
From: Wyatt Johnson <wyattjoh@gmail.com>
Date: Mon, 29 Jan 2018 15:29:55 -0700
Subject: [PATCH] only users that have approved usernames may comment

---
 perms/reducers/mutation.js                   |  4 ++-
 test/server/graph/mutations/createComment.js | 38 ++++++++++++++++++++
 2 files changed, 41 insertions(+), 1 deletion(-)

diff --git a/perms/reducers/mutation.js b/perms/reducers/mutation.js
index 3e73afbc9..73ee7ef28 100644
--- a/perms/reducers/mutation.js
+++ b/perms/reducers/mutation.js
@@ -15,7 +15,9 @@ module.exports = (user, perm) => {
     case types.EDIT_COMMENT:
       // Anyone can do these things if they aren't suspended, banned, or blocked
       // as they're editing their username.
-      return !['UNSET', 'REJECTED'].includes(user.status.username.status);
+      return !['UNSET', 'REJECTED', 'CHANGED'].includes(
+        user.status.username.status
+      );
 
     case types.ADD_COMMENT_TAG:
     case types.REMOVE_COMMENT_TAG:
diff --git a/test/server/graph/mutations/createComment.js b/test/server/graph/mutations/createComment.js
index 720297e12..bd89b31a6 100644
--- a/test/server/graph/mutations/createComment.js
+++ b/test/server/graph/mutations/createComment.js
@@ -270,6 +270,44 @@ describe('graph.mutations.createComment', () => {
     });
   });
 
+  describe('user with different username statuses', () => {
+    beforeEach(() => AssetModel.create({ id: '123' }));
+
+    [
+      { status: 'UNSET', error: true },
+      { status: 'SET', error: false },
+      { status: 'APPROVED', error: false },
+      { status: 'REJECTED', error: true },
+      { status: 'CHANGED', error: true },
+    ].forEach(({ status, error }) => {
+      describe(`user.status.username.status=${status}`, () => {
+        it(`${error ? 'can not' : 'can'} create a comment`, async () => {
+          const context = new Context({
+            user: new UserModel({ status: { username: { status } } }),
+          });
+
+          const { data, errors } = await graphql(schema, query, {}, context);
+
+          if (errors) {
+            console.error(errors);
+          }
+          expect(errors).to.be.undefined;
+
+          if (error) {
+            expect(data.createComment).to.have.property('errors').not.null;
+            expect(data.createComment).to.have.property('comment').null;
+          } else {
+            if (data.createComment.errors) {
+              console.error(data.createComment.errors);
+            }
+            expect(data.createComment).to.have.property('errors').null;
+            expect(data.createComment).to.have.property('comment').not.null;
+          }
+        });
+      });
+    });
+  });
+
   describe('users with different roles', () => {
     beforeEach(() => AssetModel.create({ id: '123' }));