From b78f9bc1d1fadf24a8b4543260cca17d0a13897c Mon Sep 17 00:00:00 2001
From: Roy Hung <royshunhung@gmail.com>
Date: Sun, 26 Jul 2026 14:41:38 -0400
Subject: [PATCH] =?UTF-8?q?feat:=20=F0=9F=8E=B8=20setup=20logic=20to=20be?=
 =?UTF-8?q?=20able=20to=20update=20and=20delete=20comment?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

update comment.js to setup security policy to ensure users can only
modify or delete comments from them

✅ Closes: 2383
---
 .../content-types/comment/lifecycles.js       |  9 +++++++++
 .../comment/policies/comment-owner-filter.js  | 19 +++++++++++++++++++
 src/api/comment/routes/comment.js             | 11 ++++++++++-
 3 files changed, 38 insertions(+), 1 deletion(-)
 create mode 100644 src/api/comment/policies/comment-owner-filter.js

diff --git a/src/api/comment/content-types/comment/lifecycles.js b/src/api/comment/content-types/comment/lifecycles.js
index 3a56d98d..bf2088be 100644
--- a/src/api/comment/content-types/comment/lifecycles.js
+++ b/src/api/comment/content-types/comment/lifecycles.js
@@ -6,6 +6,15 @@ module.exports = {
     event.params.data.author = ctx.state.user.username;
   },
 
+  beforeUpdate(event) {
+    // Only content fields (e.g. text) are editable — prevent the owner
+    // from reassigning the comment via the update payload.
+    delete event.params.data.user;
+    delete event.params.data.author;
+    delete event.params.data.authorId;
+    delete event.params.data.idea_card;
+  },
+
   async afterCreate(event) {
     const { id: commentId, text: commentText } = event.result;
     const comment = await strapi.entityService.findOne(
diff --git a/src/api/comment/policies/comment-owner-filter.js b/src/api/comment/policies/comment-owner-filter.js
new file mode 100644
index 00000000..f73c2ba2
--- /dev/null
+++ b/src/api/comment/policies/comment-owner-filter.js
@@ -0,0 +1,19 @@
+module.exports = async (ctx) => {
+  const user = ctx.state.user;
+
+  if (!user || !ctx.params?.id) {
+    return false;
+  }
+
+  const comment = await strapi.entityService.findOne(
+    "api::comment.comment",
+    ctx.params.id,
+    { populate: ["user"] }
+  );
+
+  if (!comment || !comment.user) {
+    return false;
+  }
+
+  return comment.user.id === user.id;
+};
diff --git a/src/api/comment/routes/comment.js b/src/api/comment/routes/comment.js
index 888b81ae..a37ec74f 100644
--- a/src/api/comment/routes/comment.js
+++ b/src/api/comment/routes/comment.js
@@ -6,4 +6,13 @@
 
 const { createCoreRouter } = require('@strapi/strapi').factories;
 
-module.exports = createCoreRouter('api::comment.comment');
+module.exports = createCoreRouter('api::comment.comment', {
+  config: {
+    update: {
+      policies: ['api::comment.comment-owner-filter'],
+    },
+    delete: {
+      policies: ['api::comment.comment-owner-filter'],
+    },
+  },
+});