Comments on drops (refs #280) ca0c443c30cf

-- Comments on a drop (oxygenhub#280): its readers', in Markdown; the

-- author, the drop's owner or a site administrator deletes one.

CREATE TABLE drop_comments (

    id         BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,

    repo_id    BIGINT NOT NULL REFERENCES repositories(id) ON DELETE CASCADE,

    author_id  BIGINT REFERENCES accounts(id) ON DELETE SET NULL,

    author     TEXT NOT NULL DEFAULT '',

    body       TEXT NOT NULL,

    created_ms BIGINT NOT NULL

);

CREATE INDEX drop_comments_by_drop ON drop_comments (repo_id, created_ms);

-- Comments on a drop (oxygenhub#280): its readers', in Markdown; the

-- author, the drop's owner or a site administrator deletes one.

CREATE TABLE drop_comments (

    id         INTEGER PRIMARY KEY,

    repo_id    INTEGER NOT NULL REFERENCES repositories(id) ON DELETE CASCADE,

    author_id  INTEGER REFERENCES accounts(id) ON DELETE SET NULL,

    author     TEXT NOT NULL DEFAULT '',

    body       TEXT NOT NULL,

    created_ms INTEGER NOT NULL

);

CREATE INDEX drop_comments_by_drop ON drop_comments (repo_id, created_ms);

- **Comments on drops (#280):** a drop's page has comments: signed-in readers write them in Markdown, the drop's owner is told, and the author, the owner or a site administrator deletes one.

/// A comment on a drop (#280).

#[derive(Clone, Debug, FromRow)]

pub struct DropComment {

    pub id: i64,

    pub repo_id: i64,

    pub author_id: Option<i64>,

    pub author: String,

    pub body: String,

    pub created_ms: i64,

}

pub async fn add_drop_comment(pool: &Pool, repo_id: i64, author_id: i64, author: &str, body: &str) -> sqlx::Result<i64> {

    sqlx::query_scalar("INSERT INTO drop_comments (repo_id, author_id, author, body, created_ms) VALUES ($1, $2, $3, $4, $5) RETURNING id")

        .bind(repo_id)

        .bind(author_id)

        .bind(author)

        .bind(body)

        .bind(now_ms())

        .fetch_one(pool)

        .await

}

/// A drop's comments, oldest first.

pub async fn drop_comments(pool: &Pool, repo_id: i64) -> sqlx::Result<Vec<DropComment>> {

    sqlx::query_as("SELECT * FROM drop_comments WHERE repo_id = $1 ORDER BY created_ms, id").bind(repo_id).fetch_all(pool).await

}

pub async fn drop_comment(pool: &Pool, repo_id: i64, id: i64) -> sqlx::Result<Option<DropComment>> {

    sqlx::query_as("SELECT * FROM drop_comments WHERE repo_id = $1 AND id = $2").bind(repo_id).bind(id).fetch_optional(pool).await

}

pub async fn delete_drop_comment(pool: &Pool, repo_id: i64, id: i64) -> sqlx::Result<()> {

    sqlx::query("DELETE FROM drop_comments WHERE repo_id = $1 AND id = $2").bind(repo_id).bind(id).execute(pool).await?;

    Ok(())

}

        "proposal.comment" | "issue.comment" | "drop.comment" => "💬 New Comment",

    /// Its comments, rendered, and whether the viewer may delete each (#280).

    comments: Vec<ShownComment>,

/// A comment as the drop's page shows it.

pub struct ShownComment {

    pub id: i64,

    pub author: String,

    pub created_ms: i64,

    pub html: String,

    pub may_delete: bool,

}

    let comments = db::repos::drop_comments(&app.db, row.id)

        .await

        .unwrap_or_default()

        .into_iter()

        .map(|c| ShownComment {

            may_delete: may_delete_comment(viewer, &row, &c),

            id: c.id,

            html: markdown::render(&c.body, "", ""),

            author: c.author,

            created_ms: c.created_ms,

        })

        .collect();

        comments,

}

/// Who may delete a comment: its author, the drop's owner, a site

/// administrator.

fn may_delete_comment(viewer: &Viewer, row: &db::repos::RepoRow, c: &db::repos::DropComment) -> bool {

    viewer.account().is_some_and(|a| !a.blocked() && (Some(a.id) == c.author_id || a.username == row.owner || a.is_admin))

}

/// The longest comment taken, in bytes.

const COMMENT_MAX: usize = 64 * 1024;

#[derive(Deserialize)]

pub struct CommentForm {

    #[serde(rename = "_csrf")]

    csrf_token: String,

    body: String,

}

/// `POST /{owner}/drops/{id}/comment` (#280): a reader's comment, in

/// Markdown; the drop's owner is told.

pub async fn comment(

    State(app): State<Shared>,

    viewer: Viewer,

    Path((owner, id)): Path<(String, String)>,

    Form(f): Form<CommentForm>,

) -> Result<Response, Error> {

    let shell = Shell::new(&app, &format!("/{owner}/drops/{id}"), &viewer);

    let me = require(&viewer, &shell)?;

    csrf(&viewer, &f.csrf_token, &shell)?;

    let row = lookup(&app, &shell, &viewer, &owner, &id).await?;

    let body = f.body.trim();

    if body.is_empty() || body.len() > COMMENT_MAX || me.account.blocked() {

        return Err(Error::bad(shell, "A comment is some text, at most 64 KiB."));

    }

    let n = db::repos::add_drop_comment(&app.db, row.id, me.account.id, &me.account.username, body)

        .await

        .map_err(|e| Error::from_db(shell.clone(), e))?;

    let url = drops::url_of(&row);

    if me.account.username != row.owner {

        if let Ok(Some(owner_account)) = db::accounts::account_by_name(&app.db, &row.owner).await {

            let title = format!("{} on your drop {}", me.account.username, drops::shown_title(&row, &[]));

            crate::notify::tell(

                &app,

                "drop.comment",

                &title,

                &format!("{url}#comment-{n}"),

                &me.account.username,

                Some(row.id),

                vec![(owner_account.id, db::notify::Reason::Participating)],

            )

            .await;

        }

    }

    Ok(Redirect::to(&format!("{url}#comment-{n}")).into_response())

}

/// `POST /{owner}/drops/{id}/comment/{n}/delete` (#280).

pub async fn delete_comment(

    State(app): State<Shared>,

    viewer: Viewer,

    Path((owner, id, n)): Path<(String, String, i64)>,

    Form(f): Form<DeleteForm>,

) -> Result<Response, Error> {

    let shell = Shell::new(&app, &format!("/{owner}/drops/{id}"), &viewer);

    require(&viewer, &shell)?;

    csrf(&viewer, &f.csrf_token, &shell)?;

    let row = lookup(&app, &shell, &viewer, &owner, &id).await?;

    let c = db::repos::drop_comment(&app.db, row.id, n).await.map_err(|e| Error::from_db(shell.clone(), e))?;

    match c {

        Some(c) if may_delete_comment(&viewer, &row, &c) => {

            db::repos::delete_drop_comment(&app.db, row.id, n).await.map_err(|e| Error::from_db(shell.clone(), e))?;

            Ok(Redirect::to(&format!("{}#comments", drops::url_of(&row))).into_response())

        }

        _ => Err(Error::not_found(shell)),

    }

        .route("/{owner}/drops/{id}/comment", post(drops::comment))

        .route("/{owner}/drops/{id}/comment/{n}/delete", post(drops::delete_comment))

    // Comments: in Markdown; its owner is told; the author or the owner

    // deletes one, nobody else.

    let comment = |cookie: String, body: &'static str| {

        let (app, source) = (app.clone(), source.clone());

        async move {

            let csrf = csrf_of(&get(&app, &source, Some(&cookie)).await.body);

            let r = post(&app, &format!("{source}/comment"), Some(&cookie), &format!("_csrf={csrf}&body={}", enc(body))).await;

            assert_eq!(r.status, StatusCode::SEE_OTHER, "{}", r.body);

            r.location.unwrap().rsplit_once("#comment-").unwrap().1.to_string()

        }

    };

    let from_andy = comment(andy.clone(), "Nice **notes**").await;

    let from_carol = comment(carol.clone(), "Thanks").await;

    let page = get(app, &source, None).await.body;

    assert!(page.contains("<strong>notes</strong>") && page.contains(&format!("id=\"comment-{from_andy}\"")), "{page}");

    assert!(page.contains("Sign in to comment."));

    let carol_row = db::accounts::account_by_name(&app.db, "carol").await.unwrap().unwrap();

    let told = db::notify::inbox(&app.db, carol_row.id, 10).await.unwrap();

    assert!(told.iter().any(|n| n.kind == "drop.comment" && n.url.ends_with(&format!("#comment-{from_andy}"))), "{told:?}");

    let delete = |cookie: String, n: String| {

        let (app, source) = (app.clone(), source.clone());

        async move {

            let csrf = csrf_of(&get(&app, &source, Some(&cookie)).await.body);

            post(&app, &format!("{source}/comment/{n}/delete"), Some(&cookie), &format!("_csrf={csrf}")).await.status

        }

    };

    let dave = register(app, "dave").await;

    assert_eq!(delete(dave, from_andy.clone()).await, StatusCode::NOT_FOUND, "not someone else's");

    assert_eq!(delete(carol.clone(), from_andy.clone()).await, StatusCode::SEE_OTHER, "the drop's owner may");

    assert_eq!(delete(carol.clone(), from_carol.clone()).await, StatusCode::SEE_OTHER, "and the author");

    assert!(get(app, &source, None).await.body.contains("No comments yet."));

- **Comments** (#280): signed-in readers comment on a drop in Markdown (`POST /{owner}/drops/{id}/comment`, table `drop_comments`, migration 0092, at most 64 KiB), shown oldest first under its files; the owner is told (`drop.comment`); the author, the owner or a site administrator deletes one (`…/comment/{n}/delete`).

<section class="card-box drop-comments" id="comments">

  <div class="card-head"><h2>Comments</h2><span class="count-chip">{{ comments.len() }}</span></div>

  {% if comments.is_empty() %}<p class="empty small">No comments yet.</p>{% else %}

  <ul class="rows drop-comment-rows">{% for c in comments %}

    <li id="comment-{{ c.id }}">

      <div class="drop-comment">

        <div class="small mute"><a href="/{{ c.author }}">{{ c.author }}</a> · <time title="{{ c.created_ms|when_i }}">{{ c.created_ms|ago_i }}</time></div>

        <div class="doc">{{ c.html|safe }}</div>

      </div>

      {% if c.may_delete %}<form class="inline" method="post" action="{{ repo.url }}/comment/{{ c.id }}/delete" data-confirm="Delete this comment?"><input type="hidden" name="_csrf" value="{{ shell.csrf }}"><button class="small danger">Delete</button></form>{% endif %}

    </li>{% endfor %}

  </ul>{% endif %}

  {% if signed_in %}<form class="pad drop-comment-form" method="post" action="{{ repo.url }}/comment">

    <input type="hidden" name="_csrf" value="{{ shell.csrf }}">

    <label for="comment-body" class="small mute">Comment (Markdown)</label>

    <textarea id="comment-body" name="body" rows="4" required maxlength="65536"></textarea>

    <div class="actions"><button type="submit">COMMENT</button></div>

  </form>{% else %}<p class="small mute pad">Sign in to comment.</p>{% endif %}

</section>

.drop-comment-rows li { align-items: flex-start; }

.drop-comment { flex: 1; min-width: 0; }

.drop-comment .doc { margin-top: 4px; overflow-wrap: anywhere; }

.drop-comment-form textarea { width: 100%; box-sizing: border-box; }