yusufipek/OpenFrame
1
0
Fork 0
mirror of https://github.com/yusufipk/OpenFrame.git synced 2026-09-11 09:36:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(comments): enhance comment deletion permissions to allow project owners and admins to delete any comment

Browse Source
This commit is contained in:
Yusuf İpek
2026-04-10 21:56:02 +03:00
parent 11abb5dbcb
commit 5beaa26fb4
1 changed files with 10 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/api/comments/[commentId]/route.ts
+10 -6
View File
@@ -276,18 +276,22 @@ export async function DELETE(request: NextRequest, { params }: RouteParams) {
return apiErrors.notFound('Comment');
}
const project = comment.version.video.project;
const userId = session?.user?.id ?? null;
const isAuthor = !!userId && comment.authorId === userId;
let canDeleteOwnComment = isAuthor;
if (!userId) {
// Project owners/admins and workspace admins can delete any comment
const access = userId ? await checkProjectAccess(project, userId, { intent: 'manage' }) : null;
const isPrivilegedUser = !!access?.canEdit;
let canDelete = isAuthor || isPrivilegedUser;
if (!canDelete && !userId) {
const guestIdentityId = getGuestIdentityFromRequest(request);
const isGuestAuthor = !comment.authorId
&& !!comment.guestIdentityId
&& guestIdentityId === comment.guestIdentityId;
if (isGuestAuthor) {
const project = comment.version.video.project;
const shareSession = getShareSessionFromRequest(request, comment.version.video.id);
const shareAccess = shareSession
? await validateShareLinkAccess({
@@ -302,12 +306,12 @@ export async function DELETE(request: NextRequest, { params }: RouteParams) {
if (!hasGuestAccess) {
return apiErrors.forbidden('Access denied');
}
canDeleteOwnComment = true;
canDelete = true;
}
}
if (!canDeleteOwnComment) {
return apiErrors.forbidden('You can only delete your own comments');
if (!canDelete) {
return apiErrors.forbidden('You do not have permission to delete this comment');
}
// Collect all media URLs to delete from R2 (comment + its replies)