From 2733a89a4f07a368561faf1c6ea565ed67f4e54e Mon Sep 17 00:00:00 2001
From: cybdo <ryan@cybdo.me>
Date: Thu, 3 Sep 2026 12:09:41 +1000
Subject: [PATCH] allow fraud perm to unflag

---
 app/controllers/admin/projects_controller.rb | 8 +++-----
 app/controllers/admin/reviews_controller.rb  | 3 ++-
 app/javascript/pages/Admin/Reviews/Show.tsx  | 4 ++--
 3 files changed, 7 insertions(+), 8 deletions(-)

diff --git a/app/controllers/admin/projects_controller.rb b/app/controllers/admin/projects_controller.rb
index 5b267ae6..6785e041 100644
--- a/app/controllers/admin/projects_controller.rb
+++ b/app/controllers/admin/projects_controller.rb
@@ -1,7 +1,7 @@
 class Admin::ProjectsController < Admin::ApplicationController
   REVIEW_SCREEN_ACTIONS = %i[review repo_tree commit_stats changes_since_review ai_requirements_check ai_requirements_check_status].freeze
 
-  before_action :require_projects_permission!, except: REVIEW_SCREEN_ACTIONS
+  before_action :require_projects_permission!, except: REVIEW_SCREEN_ACTIONS + [ :unflag_for_review ]
   before_action :require_review_screen_access!, only: REVIEW_SCREEN_ACTIONS
   before_action :set_project, only: [ :show, :review, :destroy, :restore, :toggle_hidden, :toggle_shadow_ban, :toggle_staff_pick, :change_tier, :add_note, :destroy_note, :update_note, :flag_for_review, :unflag_for_review, :mark_unbuilt, :reverse_review, :ai_requirements_check, :ai_requirements_check_status, :repo_tree, :commit_stats, :changes_since_review, :send_checkpoint_message, :send_dm_message ]
 
@@ -344,10 +344,8 @@ def flag_for_review
   end
 
   def unflag_for_review
-    authorize @project, :review?
-
-    unless current_user.superadmin?
-      redirect_back fallback_location: admin_review_path(@project), alert: "Only superadmins can clear a review flag."
+    unless current_user.superadmin? || current_user.has_permission?("fraud")
+      redirect_back fallback_location: admin_review_path(@project), alert: "Only superadmins or fraud reviewers can clear a review flag."
       return
     end
 
diff --git a/app/controllers/admin/reviews_controller.rb b/app/controllers/admin/reviews_controller.rb
index 3fef77e8..18f9013a 100644
--- a/app/controllers/admin/reviews_controller.rb
+++ b/app/controllers/admin/reviews_controller.rb
@@ -120,7 +120,8 @@ def show
       can: {
         review: can_review,
         requirements_check: policy(@project).requirements_check?,
-        claim: !can_review || claim[:locked_by].nil? || current_user.superadmin?
+        claim: !can_review || claim[:locked_by].nil? || current_user.superadmin?,
+        unflag: current_user.superadmin? || current_user.has_permission?("fraud")
       },
       claim: claim,
       session_stats: current_user.superadmin? ? session_stats(@project) : nil,
diff --git a/app/javascript/pages/Admin/Reviews/Show.tsx b/app/javascript/pages/Admin/Reviews/Show.tsx
index 91bd6c87..4c693278 100644
--- a/app/javascript/pages/Admin/Reviews/Show.tsx
+++ b/app/javascript/pages/Admin/Reviews/Show.tsx
@@ -61,7 +61,7 @@ export default function AdminReviewsShow({
   reviewer: Reviewer
   review_history: ReviewEvent[]
   notes: ReviewNote[]
-  can: { review: boolean; requirements_check: boolean; claim: boolean }
+  can: { review: boolean; requirements_check: boolean; claim: boolean; unflag: boolean }
   claim: ClaimState
   session_stats: SessionStats | null
   checkpoint_channel_configured: boolean
@@ -684,7 +684,7 @@ export default function AdminReviewsShow({
         <FlagBanner
           reason={project.flag_reason}
           flaggedBy={project.flagged_by_name}
-          canUnflag={reviewer.is_superadmin}
+          canUnflag={can.unflag}
           onUnflag={unflag}
           unflagging={unflagging}
         />