From dc0c3b4a676072083eb1a202197e3b3ae9602e56 Mon Sep 17 00:00:00 2001
From: Wyatt Johnson <wyattjoh@gmail.com>
Date: Wed, 11 Apr 2018 15:58:04 -0600
Subject: [PATCH] Authors cannot see their own status history

---
 graph/resolvers/comment.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/graph/resolvers/comment.js b/graph/resolvers/comment.js
index 7fff6a1ea..b174dd5ae 100644
--- a/graph/resolvers/comment.js
+++ b/graph/resolvers/comment.js
@@ -68,16 +68,16 @@ const Comment = {
 // Decorate the Comment type resolver with a tags field.
 decorateWithTags(Comment);
 
-// Protect direct action access.
+// Protect direct action and status history access.
 decorateWithPermissionCheck(Comment, {
   actions: [SEARCH_ACTIONS],
+  status_history: [SEARCH_COMMENT_STATUS_HISTORY],
 });
 
 // Protect privileged fields.
 decorateWithPermissionCheck(
   Comment,
   {
-    status_history: [SEARCH_COMMENT_STATUS_HISTORY],
     body_history: [VIEW_BODY_HISTORY],
   },
   checkSelfField('author_id')