diff --git a/graph/loaders/comments.js b/graph/loaders/comments.js index adfa71eb4..2eb0811a6 100644 --- a/graph/loaders/comments.js +++ b/graph/loaders/comments.js @@ -91,17 +91,19 @@ const getParentCountsByAssetID = (context, asset_ids) => { const getCommentCountByQuery = (context, {ids, statuses, asset_id, parent_id, author_id, tags, action_type}) => { let query = CommentModel.find(); + // If user queries for statuses other than NONE and/or ACCEPTED statuses, it needs + // special priviledges. if ( - (context.user != null && context.user.can(SEARCH_NON_NULL_OR_ACCEPTED_COMMENTS)) || - statuses && statuses.every((status) => ['NONE', 'ACCEPTED'].includes(status)) + statuses && statuses.some((status) => !['NONE', 'ACCEPTED'].includes(status)) && + (context.user == null || !context.user.can(SEARCH_NON_NULL_OR_ACCEPTED_COMMENTS)) ) { - if (statuses) { - query = query.where({status: {$in: statuses}}); - } - } else { return null; } + if (statuses) { + query = query.where({status: {$in: statuses}}); + } + if (ids) { query = query.where({id: {$in: ids}}); } @@ -286,23 +288,19 @@ const executeWithSort = async (ctx, query, {cursor, sortOrder, sortBy, limit}) = const getCommentsByQuery = async (ctx, {ids, statuses, asset_id, parent_id, author_id, limit, cursor, sortOrder, sortBy, excludeIgnored, tags, action_type}) => { let comments = CommentModel.find(); - // Only administrators can search for comments with statuses that are not - // `null`, or `'ACCEPTED'`. + // If user queries for statuses other than NONE and/or ACCEPTED statuses, it needs + // special priviledges. if ( - (ctx.user != null && ctx.user.can(SEARCH_NON_NULL_OR_ACCEPTED_COMMENTS)) || - statuses && statuses.every((status) => ['NONE', 'ACCEPTED'].includes(status)) + statuses && statuses.some((status) => !['NONE', 'ACCEPTED'].includes(status)) && + (ctx.user == null || !ctx.user.can(SEARCH_NON_NULL_OR_ACCEPTED_COMMENTS)) ) { - if (statuses && statuses.length > 0) { - comments = comments.where({ - status: { - $in: statuses - } - }); - } - } else { return null; } + if (statuses) { + comments = comments.where({status: {$in: statuses}}); + } + if (ctx.user != null && ctx.user.can(SEARCH_OTHERS_COMMENTS) && action_type) { comments = comments.where({ [`action_counts.${sc(action_type.toLowerCase())}`]: { diff --git a/graph/mutators/comment.js b/graph/mutators/comment.js index 2aee766a5..a1315d847 100644 --- a/graph/mutators/comment.js +++ b/graph/mutators/comment.js @@ -398,7 +398,7 @@ const moderationPhases = [ * @param {String} body body of the comment * @param {String} [asset_id] asset for the comment * @param {Object} [wordlist={}] the results of the wordlist scan - * @return {Object} resolves to the comment's status and actions + * @return {Promise} resolves to the comment's status and actions */ const resolveCommentModeration = async (context, comment) => { diff --git a/graph/resolvers/asset.js b/graph/resolvers/asset.js index 2680f9f76..b5fd92d34 100644 --- a/graph/resolvers/asset.js +++ b/graph/resolvers/asset.js @@ -23,7 +23,6 @@ const Asset = { // Include the asset id in the search. query.asset_id = id; - query.statuses = ['NONE', 'ACCEPTED']; return Comments.getByQuery(query); },