yusufipek/OpenFrame
1
0
Fork 0
mirror of https://github.com/yusufipk/OpenFrame.git synced 2026-09-11 09:36:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(comments): Grant workspace members access to comments

Browse Source 
- Allow workspace members to view comments
- Enable workspace members to resolve/unresolve comments
- Permit workspace members to delete comments
- Verify workspace membership or ownership for access
This commit is contained in:
Yusuf İpek
2026-02-08 13:54:04 +03:00
parent f8afec0291
commit 05150d5a20
6 changed files with 189 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/api/versions/[versionId]/comments/route.ts
+38 -2
View File
@@ -39,7 +39,25 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
const isMember = project.members.length > 0;
const isPublic = project.visibility === 'PUBLIC';
if (!isOwner && !isMember && !isPublic) {
// Check workspace membership for access
let isWorkspaceMember = false;
if (!isOwner && !isMember && !isPublic && session?.user?.id) {
const wsMember = await db.workspaceMember.findUnique({
where: {
workspaceId_userId: {
workspaceId: project.workspaceId,
userId: session.user.id,
},
},
});
const wsOwner = await db.workspace.findUnique({
where: { id: project.workspaceId },
select: { ownerId: true },
});
isWorkspaceMember = !!wsMember || wsOwner?.ownerId === session.user.id;
}
if (!isOwner && !isMember && !isPublic && !isWorkspaceMember) {
return apiErrors.forbidden('Access denied');
}
@@ -109,8 +127,26 @@ export async function POST(request: NextRequest, { params }: RouteParams) {
const hasCommentLink = project.shareLinks.length > 0;
const isPublic = project.visibility === 'PUBLIC';
// Check workspace membership for comment access
let isWorkspaceMember = false;
if (!isOwner && !isMember && !isPublic && !hasCommentLink && session?.user?.id) {
const wsMember = await db.workspaceMember.findUnique({
where: {
workspaceId_userId: {
workspaceId: project.workspaceId,
userId: session.user.id,
},
},
});
const wsOwner = await db.workspace.findUnique({
where: { id: project.workspaceId },
select: { ownerId: true },
});
isWorkspaceMember = !!wsMember || wsOwner?.ownerId === session.user.id;
}
// Check if user can comment
const canComment = isOwner || isMember || isPublic || hasCommentLink;
const canComment = isOwner || isMember || isPublic || hasCommentLink || isWorkspaceMember;
if (!canComment) {
return apiErrors.forbidden('Access denied');
}