diff --git a/graph/resolvers/user.js b/graph/resolvers/user.js index 8a6ca69e3..6aba327ad 100644 --- a/graph/resolvers/user.js +++ b/graph/resolvers/user.js @@ -14,7 +14,7 @@ const User = { // If the user is not an admin, only return comment list for the owner of // the comments. - if (user && (user.can('SEARCH_OTHERS_COMMENTS') || user.id === id)) { + if (user && (user.can('SEARCH_OTHERS_COMMENTZ') || user.id === id)) { return Comments.getByQuery({author_id: id, sort: 'REVERSE_CHRONOLOGICAL'}); } diff --git a/models/user.js b/models/user.js index 1a7b0fa7b..3d12d49e9 100644 --- a/models/user.js +++ b/models/user.js @@ -190,7 +190,7 @@ UserSchema.method('verifyPassword', function(password) { * operation. */ UserSchema.method('can', function(...actions) { - return can(this, null, ...actions); + return can(this, ...actions); }); // Create the User model. diff --git a/perms/mutationReducer.js b/perms/mutationReducer.js index 5f763805d..0078c327b 100644 --- a/perms/mutationReducer.js +++ b/perms/mutationReducer.js @@ -15,7 +15,7 @@ module.exports = { REMOVE_COMMENT_TAG: 'REMOVE_COMMENT_TAG', UPDATE_USER_ROLES: 'UPDATE_USER_ROLES', UPDATE_CONFIG: 'UPDATE_CONFIG', - checkRoles: function (user, perm, context) { + checkRoles: function (user, perm) { switch (perm) { case this.CREATE_COMMENT: return true; diff --git a/perms/queryReducer.js b/perms/queryReducer.js index bea059639..92f1566d5 100644 --- a/perms/queryReducer.js +++ b/perms/queryReducer.js @@ -10,7 +10,7 @@ module.exports = { SEARCH_NON_NULL_OR_ACCEPTED_COMMENTS: 'SEARCH_NON_NULL_OR_ACCEPTED_COMMENTS', SEARCH_OTHERS_COMMENTS: 'SEARCH_OTHERS_COMMENTS', SEARCH_COMMENT_METRICS: 'SEARCH_COMMENT_METRICS', - checkRoles: function (user, perm, context) { + checkRoles: function (user, perm) { switch (perm) { case this.SEARCH_ASSETS: return check(user, ['ADMIN', 'MODERATOR']); diff --git a/perms/rootReducer.js b/perms/rootReducer.js index 344c33ada..7abf92753 100644 --- a/perms/rootReducer.js +++ b/perms/rootReducer.js @@ -1,9 +1,15 @@ module.exports = { - checkRoles: function (user, perm, context) { + DUMMY_ROLE: 'DUMMY_ROLE', + checkRoles: function (user, perm) { // this runs before everything if (user.status === 'BANNED') { return false; } + + switch (perm) { + default: + break; + } } };