feat(comments): scaffolding public comments

packages/frontend/src/main/components/comments/CommentThreadViewer.vue

@@ -192,6 +192,7 @@ export default {
           stream(id: $streamId) {
             id
             role
+            allowPublicComments
           }
         }
       `,

packages/server/modules/comments/graph/resolvers/comments.js

@@ -117,7 +117,16 @@ module.exports = {
     },
 
     async commentCreate(parent, args, context) {
-      await authorizeResolver(context.userId, args.input.streamId, 'stream:reviewer')
+      if (!context.userId)
+        throw new ForbiddenError('Only registered users can comment.')
+
+      const stream = await getStream({
+        streamId: args.input.streamId,
+        userId: context.userId
+      })
+
+      if (!stream.allowPublicComments)
+        await authorizeResolver(context.userId, args.input.streamId, 'stream:reviewer')
 
       const id = await createComment({ userId: context.userId, input: args.input })
 
@@ -170,7 +179,16 @@ module.exports = {
     },
 
     async commentReply(parent, args, context) {
-      await authorizeResolver(context.userId, args.input.streamId, 'stream:reviewer')
+      if (!context.userId)
+        throw new ForbiddenError('Only registered users can comment.')
+
+      const stream = await getStream({
+        streamId: args.input.streamId,
+        userId: context.userId
+      })
+
+      if (!stream.allowPublicComments)
+        await authorizeResolver(context.userId, args.input.streamId, 'stream:reviewer')
 
       const id = await createCommentReply({
         authorId: context.userId,

packages/server/modules/comments/migrations/20220412150558_stream-public-comments.js

@@ -0,0 +1,12 @@
+/* istanbul ignore file */
+exports.up = async (knex) => {
+  await knex.schema.alterTable('streams', (table) => {
+    table.boolean('allowPublicComments').defaultTo(false)
+  })
+}
+
+exports.down = async (knex) => {
+  await knex.schema.alterTable('streams', (table) => {
+    table.dropColumn('allowPublicComments')
+  })
+}

packages/server/modules/core/graph/resolvers/streams.js

@@ -222,7 +222,8 @@ module.exports = {
         streamId: args.stream.id,
         name: args.stream.name,
         description: args.stream.description,
-        isPublic: args.stream.isPublic
+        isPublic: args.stream.isPublic,
+        allowPublicComments: args.stream.allowPublicComments
       }
 
       await updateStream(update)

packages/server/modules/core/graph/schemas/streams.graphql

@@ -24,6 +24,7 @@ type Stream {
   name: String!
   description: String
   isPublic: Boolean!
+  allowPublicComments: Boolean!
   """
   Your role for this stream. `null` if request is not authenticated, or the stream is not explicitly shared with you.
   """
@@ -164,6 +165,7 @@ input StreamUpdateInput {
   name: String
   description: String
   isPublic: Boolean
+  allowPublicComments: Boolean
 }
 
 input StreamGrantPermissionInput {