fix: any user is able to remove best answers (#96)

* fix: any user is able to remove best answers * Apply fixes from StyleCI --------- Co-authored-by: StyleCI Bot <[email protected]>
FriendsOfFlarum · Jul 16, 2024 · ca18880 · ca18880
1 parent 492ef15
commit ca18880
Show file tree

Hide file tree

Showing 3 changed files with 88 additions and 0 deletions.
diff --git a/src/BestAnswerRepository.php b/src/BestAnswerRepository.php
@@ -53,6 +53,11 @@ public function canSelectPostAsBestAnswer(User $user, Post $post): bool
         return true;
     }
 
+    public function canRemoveBestAnswer(User $user, Discussion $discussion): bool
+    {
+        return self::canSelectBestAnswer($user, $discussion);
+    }
+
     public function tagEnabledForBestAnswer(Discussion $discussion): bool
     {
         $enabled = false;

diff --git a/src/Listeners/SaveBestAnswerToDatabase.php b/src/Listeners/SaveBestAnswerToDatabase.php
@@ -93,6 +93,10 @@ public function handle(Saving $event)
 
     protected function removeBestAnswer(Discussion $discussion, User $actor): void
     {
+        if (!$this->bestAnswer->canRemoveBestAnswer($actor, $discussion)) {
+            throw new PermissionDeniedException();
+        }
+
         /** @var Post|null $post */
         $post = $discussion->bestAnswerPost;
 

diff --git a/tests/integration/api/UnsetBestAnswerTest.php b/tests/integration/api/UnsetBestAnswerTest.php
@@ -31,6 +31,7 @@ public function setUp(): void
             'users' => [
                 $this->normalUser(),
                 ['id' => 3, 'username' => 'normal2', 'email' => '[email protected]', 'is_email_confirmed' => 1, 'best_answer_count' => 0],
+                ['id' => 4, 'username' => 'moderator', 'email' => 'mod:machine.local', 'is_email_confirmed' => 1],
             ],
             'tags' => [
                 ['id' => 2, 'name' => 'Q&A', 'slug' => 'q-a', 'description' => 'Q&A description', 'color' => '#FF0000', 'position' => 0, 'parent_id' => null, 'is_restricted' => false, 'is_hidden' => false, 'is_qna' => true],
@@ -46,6 +47,13 @@ public function setUp(): void
             'discussion_tag' => [
                 ['discussion_id' => 1, 'tag_id' => 2],
             ],
+            'group_permission' => [
+                ['permission' => 'discussion.selectBestAnswerOwnDiscussion', 'group_id' => 3],
+                ['permission' => 'discussion.selectBestAnswerNotOwnDiscussion', 'group_id' => 4],
+            ],
+            'group_user' => [
+                ['user_id' => 4, 'group_id' => 4],
+            ],
         ]);
     }
 
@@ -140,4 +148,75 @@ public function user_can_unset_best_answer_in_own_discussion_and_select_a_differ
         $attributes = $data['data']['attributes'];
         $this->assertEquals(3, $attributes['hasBestAnswer'], 'Expected best answer post ID to be 3');
     }
+
+    public function noPermissionUserProvider(): array
+    {
+        return [
+            [3],
+        ];
+    }
+
+    public function withPermissionUserProvider(): array
+    {
+        return [
+            [2],
+            [4],
+        ];
+    }
+
+    /**
+     * @test
+     *
+     * @dataProvider noPermissionUserProvider
+     */
+    public function user_without_permission_cannot_unset_a_best_answer(int $userId)
+    {
+        $response = $this->send(
+            $this->request(
+                'PATCH',
+                '/api/discussions/1',
+                [
+                    'json' => [
+                        'data' => [
+                            'attributes' => [
+                                'bestAnswerPostId' => 0,
+                            ],
+                        ],
+
+                    ],
+                    'authenticatedAs' => $userId,
+                ],
+            )
+        );
+
+        $this->assertEquals(403, $response->getStatusCode());
+    }
+
+    /**
+     * @test
+     *
+     * @dataProvider withPermissionUserProvider
+     */
+    public function user_with_permission_can_unset_a_best_answer(int $userId)
+    {
+        $response = $this->send(
+            $this->request(
+                'PATCH',
+                '/api/discussions/1',
+                [
+                    'json' => [
+                        'data' => [
+                            'attributes' => [
+                                'bestAnswerPostId' => 0,
+                            ],
+                        ],
+
+                    ],
+                    'authenticatedAs' => $userId,
+                ],
+            )
+        );
+
+        $this->assertEquals(200, $response->getStatusCode());
+    }
 }