Can't edit comment outside of edit window

graph/mutators/comment.js

@@ -246,7 +246,16 @@ const editComment = async ({user, loaders: {Comments}}, {id, edit}) => {
     return status;
   };
   const status = await determineStatusForComment({body, asset_id});
-  await CommentsService.edit(id, Object.assign({status}, edit));
+  try {
+    await CommentsService.edit(comment, Object.assign({status}, edit));
+  } catch (error) {
+    switch (error.name) {
+    case 'EditWindowExpired':
+      throw errors.ErrNotAuthorized;
+    default:
+      throw error;
+    }
+  }
 };
 
 module.exports = (context) => {

package.json

@@ -97,6 +97,7 @@
     "resolve": "^1.3.2",
     "semver": "^5.3.0",
     "simplemde": "^1.11.2",
+    "timekeeper": "^1.0.0",
     "uuid": "^2.0.3"
   },
   "devDependencies": {

services/comments.js

@@ -15,6 +15,8 @@ const STATUSES = [
   'NONE',
 ];
 
+const EDIT_WINDOW_MS = 5 * 60 * 60; // 5 minutes
+
 module.exports = class CommentsService {
 
   /**
@@ -49,13 +51,32 @@ module.exports = class CommentsService {
 
   /**
    * Edit a Comment
+   * @param {CommentModel|String} comment you want to edit (or its ID)
    * @param {String} body  the new Comment body
    * @param {String} status  the new Comment status
    */
-  static async edit(id, {body, status}) {
+  static async edit(comment, {body, status, ignoreEditWindow}) {
+    if (typeof comment === 'string') {
+
+      // it's an id
+      comment = await this.findById(comment);
+    }
+    const lastEditDate = (comment) => {
+      const {created_at, body_history} = comment;
+      const lastEdit = body_history[body_history.length - 1];
+      return lastEdit.created_at || created_at;
+    };
+    const editWindowExpired = (new Date() - lastEditDate(comment)) > EDIT_WINDOW_MS;
+    if (( ! ignoreEditWindow) && editWindowExpired) {
+      throw Object.assign(new Error('Edit window is over.'), {
+        name: 'EditWindowExpired'
+      });
+    }
     if (status && ! STATUSES.includes(status)) {
       throw new Error(`status ${status} is not supported`);
     }
+
+    const {id} = comment;
     const {nModified} = await CommentModel.update({id}, {
       $set: {
         body,

test/server/graph/mutations/editComment.js

@@ -1,5 +1,6 @@
 const expect = require('chai').expect;
 const {graphql} = require('graphql');
+const timekeeper = require('timekeeper');
 
 const schema = require('../../../../graph/schema');
 const Context = require('../../../../graph/context');
@@ -13,6 +14,7 @@ describe('graph.mutations.editComment', () => {
   let user;
   let settings;
   beforeEach(async () => {
+    timekeeper.reset();
     settings = await SettingsService.init();
     asset = await AssetModel.create({});
     user = await UsersService.createLocalUser(
@@ -73,6 +75,34 @@ describe('graph.mutations.editComment', () => {
     expect(commentAfterEdit.status).to.equal('NONE');
   });
 
+  it('A user can\'t edit their comment outside of the edit comment time window', async () => {
+    const comment = await CommentsService.publicCreate({
+      asset_id: asset.id,
+      author_id: user.id,
+      body: `hello there! ${  String(Math.random()).slice(2)}`,
+    });
+
+    const now = new Date();
+    const oneHourFromNow = new Date(new Date(now).setHours(now.getHours() + 1));
+    timekeeper.travel(oneHourFromNow);
+
+    const newBody = 'This body should never be set';
+    const context = new Context({user});
+    const response = await graphql(schema, editCommentMutation, {}, context, {
+      id: comment.id,
+      edit: {
+        body: newBody
+      }
+    });
+    expect(response.errors).to.be.empty;
+    expect(response.data.editComment.errors).to.not.be.empty;
+    expect(response.data.editComment.errors[0].translation_key).to.equal('NOT_AUTHORIZED');
+    const commentAfterEdit = await CommentsService.findById(comment.id);
+
+    // it *hasn't* changed from the original
+    expect(commentAfterEdit.body).to.equal(comment.body);
+  });
+
   it('A user can\'t edit someone else\'s comment', async () => {
     const comment = await CommentsService.publicCreate({
       asset_id: asset.id,