From 5beaa26fb49aee359ff52b6a6e186d61e2306e93 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Yusuf=20=C4=B0pek?= <yusufipek@protonmail.com>
Date: Fri, 10 Apr 2026 21:56:02 +0300
Subject: [PATCH] feat(comments): enhance comment deletion permissions to allow
 project owners and admins to delete any comment

---
 app/api/comments/[commentId]/route.ts | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/app/api/comments/[commentId]/route.ts b/app/api/comments/[commentId]/route.ts
index 3990c11..089bddc 100644
--- a/app/api/comments/[commentId]/route.ts
+++ b/app/api/comments/[commentId]/route.ts
@@ -276,18 +276,22 @@ export async function DELETE(request: NextRequest, { params }: RouteParams) {
             return apiErrors.notFound('Comment');
         }
 
+        const project = comment.version.video.project;
         const userId = session?.user?.id ?? null;
         const isAuthor = !!userId && comment.authorId === userId;
 
-        let canDeleteOwnComment = isAuthor;
-        if (!userId) {
+        // Project owners/admins and workspace admins can delete any comment
+        const access = userId ? await checkProjectAccess(project, userId, { intent: 'manage' }) : null;
+        const isPrivilegedUser = !!access?.canEdit;
+
+        let canDelete = isAuthor || isPrivilegedUser;
+        if (!canDelete && !userId) {
             const guestIdentityId = getGuestIdentityFromRequest(request);
             const isGuestAuthor = !comment.authorId
                 && !!comment.guestIdentityId
                 && guestIdentityId === comment.guestIdentityId;
 
             if (isGuestAuthor) {
-                const project = comment.version.video.project;
                 const shareSession = getShareSessionFromRequest(request, comment.version.video.id);
                 const shareAccess = shareSession
                     ? await validateShareLinkAccess({
@@ -302,12 +306,12 @@ export async function DELETE(request: NextRequest, { params }: RouteParams) {
                 if (!hasGuestAccess) {
                     return apiErrors.forbidden('Access denied');
                 }
-                canDeleteOwnComment = true;
+                canDelete = true;
             }
         }
 
-        if (!canDeleteOwnComment) {
-            return apiErrors.forbidden('You can only delete your own comments');
+        if (!canDelete) {
+            return apiErrors.forbidden('You do not have permission to delete this comment');
         }
 
         // Collect all media URLs to delete from R2 (comment + its replies)