feat: 🎸 setup logic to be able to update and delete comment

src/api/comment/content-types/comment/lifecycles.js

@@ -6,6 +6,15 @@ module.exports = {
     event.params.data.author = ctx.state.user.username;
   },
 
+  beforeUpdate(event) {
+    // Only content fields (e.g. text) are editable — prevent the owner
+    // from reassigning the comment via the update payload.
+    delete event.params.data.user;
+    delete event.params.data.author;
+    delete event.params.data.authorId;
+    delete event.params.data.idea_card;
+  },
+
   async afterCreate(event) {
     const { id: commentId, text: commentText } = event.result;
     const comment = await strapi.entityService.findOne(

src/api/comment/policies/comment-owner-filter.js

@@ -0,0 +1,19 @@
+module.exports = async (ctx) => {
+  const user = ctx.state.user;
+
+  if (!user || !ctx.params?.id) {
+    return false;
+  }
+
+  const comment = await strapi.entityService.findOne(
+    "api::comment.comment",
+    ctx.params.id,
+    { populate: ["user"] }
+  );
+
+  if (!comment || !comment.user) {
+    return false;
+  }
+
+  return comment.user.id === user.id;
+};

src/api/comment/routes/comment.js

@@ -6,4 +6,13 @@
 
 const { createCoreRouter } = require('@strapi/strapi').factories;
 
-module.exports = createCoreRouter('api::comment.comment');
+module.exports = createCoreRouter('api::comment.comment', {
+  config: {
+    update: {
+      policies: ['api::comment.comment-owner-filter'],
+    },
+    delete: {
+      policies: ['api::comment.comment-owner-filter'],
+    },
+  },
+});