yusufipek/OpenFrame
1
0
Fork 0
mirror of https://github.com/yusufipk/OpenFrame.git synced 2026-09-11 09:36:08 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat(comments): enhance comment deletion permissions to allow project owners and admins to delete any comment

Browse Source
This commit is contained in:
Yusuf İpek
2026-04-10 21:56:02 +03:00
parent 11abb5dbcb
commit 5beaa26fb4
1 changed files with 10 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/api/comments/[commentId]/route.ts
+10 -6
View File
@@ -276,18 +276,22 @@ export async function DELETE(request: NextRequest, { params }: RouteParams) {
return apiErrors.notFound('Comment'); return apiErrors.notFound('Comment');
} }
const project = comment.version.video.project;
const userId = session?.user?.id ?? null; const userId = session?.user?.id ?? null;
const isAuthor = !!userId && comment.authorId === userId; const isAuthor = !!userId && comment.authorId === userId;
let canDeleteOwnComment = isAuthor; // Project owners/admins and workspace admins can delete any comment
if (!userId) { const access = userId ? await checkProjectAccess(project, userId, { intent: 'manage' }) : null;
const isPrivilegedUser = !!access?.canEdit;
let canDelete = isAuthor || isPrivilegedUser;
if (!canDelete && !userId) {
const guestIdentityId = getGuestIdentityFromRequest(request); const guestIdentityId = getGuestIdentityFromRequest(request);
const isGuestAuthor = !comment.authorId const isGuestAuthor = !comment.authorId
&& !!comment.guestIdentityId && !!comment.guestIdentityId
&& guestIdentityId === comment.guestIdentityId; && guestIdentityId === comment.guestIdentityId;
if (isGuestAuthor) { if (isGuestAuthor) {
const project = comment.version.video.project;
const shareSession = getShareSessionFromRequest(request, comment.version.video.id); const shareSession = getShareSessionFromRequest(request, comment.version.video.id);
const shareAccess = shareSession const shareAccess = shareSession
? await validateShareLinkAccess({ ? await validateShareLinkAccess({
@@ -302,12 +306,12 @@ export async function DELETE(request: NextRequest, { params }: RouteParams) {
if (!hasGuestAccess) { if (!hasGuestAccess) {
return apiErrors.forbidden('Access denied'); return apiErrors.forbidden('Access denied');
} }
canDeleteOwnComment = true; canDelete = true;
} }
} }
if (!canDeleteOwnComment) { if (!canDelete) {
return apiErrors.forbidden('You can only delete your own comments'); return apiErrors.forbidden('You do not have permission to delete this comment');
} }
// Collect all media URLs to delete from R2 (comment + its replies) // Collect all media URLs to delete from R2 (comment + its replies)