merge master

graph/loaders/comments.js

@@ -4,6 +4,10 @@ const {
   arrayJoinBy
 } = require('./util');
 const DataLoader = require('dataloader');
+const {
+  SEARCH_NON_NULL_OR_ACCEPTED_COMMENTS,
+  SEARCH_OTHERS_COMMENTS
+} = require('../../perms/constants');
 
 const CommentModel = require('../../models/comment');
 const UsersService = require('../../services/users');
@@ -120,7 +124,7 @@ const getParentCountByAssetIDPersonalized = async (context, {assetId, excludeIgn
     const ignoredUsers = freshUser.ignoresUsers;
     query.author_id = {$nin: ignoredUsers};
   }
-  
+
   return CommentModel.where(query).count();
 };
 
@@ -191,7 +195,7 @@ const getCountByParentIDPersonalized = async (context, {id, excludeIgnored}) =>
  * @return {Promise}          resolves to the counts of the comments from the
  *                            query
  */
-const getCommentCountByQuery = (context, {ids, statuses, asset_id, parent_id}) => {
+const getCommentCountByQuery = (context, {ids, statuses, asset_id, parent_id, author_id}) => {
   let query = CommentModel.find();
 
   if (ids) {
@@ -210,6 +214,10 @@ const getCommentCountByQuery = (context, {ids, statuses, asset_id, parent_id}) =
     query = query.where({parent_id});
   }
 
+  if (author_id) {
+    query = query.where({author_id});
+  }
+
   return CommentModel
     .find(query)
     .count();
@@ -226,7 +234,7 @@ const getCommentsByQuery = async ({user}, {ids, statuses, asset_id, parent_id, a
 
   // Only administrators can search for comments with statuses that are not
   // `null`, or `'ACCEPTED'`.
-  if (user != null && user.hasRoles('ADMIN') && statuses) {
+  if (user != null && user.can(SEARCH_NON_NULL_OR_ACCEPTED_COMMENTS) && statuses) {
     comments = comments.where({
       status: {
         $in: statuses
@@ -249,7 +257,7 @@ const getCommentsByQuery = async ({user}, {ids, statuses, asset_id, parent_id, a
   }
 
   // Only let an admin request any user or the current user request themself.
-  if (user && (user.hasRoles('ADMIN') || user.id === author_id) && author_id != null) {
+  if (user && (user.can(SEARCH_OTHERS_COMMENTS) || user.id === author_id) && author_id != null) {
     comments = comments.where({author_id});
   }
 
@@ -399,7 +407,7 @@ const genRecentComments = (_, ids) => {
  */
 const genComments = ({user}, ids) => {
   let comments;
-  if (user && user.hasRoles('ADMIN')) {
+  if (user && user.can(SEARCH_OTHERS_COMMENTS)) {
     comments = CommentModel.find({
       id: {
         $in: ids

graph/loaders/users.js

@@ -15,7 +15,7 @@ const genUserByIDs = (context, ids) => UsersService
  * @param  {Object} context   graph context
  * @param  {Object} query     query terms to apply to the users query
  */
-const getUsersByQuery = ({user}, {ids, limit, cursor, sort}) => {
+const getUsersByQuery = ({user}, {ids, limit, cursor, statuses = null, sort}) => {
 
   let users = UserModel.find();
 
@@ -27,6 +27,14 @@ const getUsersByQuery = ({user}, {ids, limit, cursor, sort}) => {
     });
   }
 
+  if (statuses != null) {
+    users = users.where({
+      status: {
+        $in: statuses
+      }
+    });
+  }
+
   if (cursor) {
     if (sort === 'REVERSE_CHRONOLOGICAL') {
       users = users.where({