focalboard
focalboard copied to clipboard
mattermost
Adding the permissions for commenter role
Adding the new permissions for add comments in the board. And showing the commenter role there.
@jespino, is the intention to check this in after the v0.16 branch? If so, the changes look good.
Thanks @jespino! I realized we may also need to check this for Delete Block, because a user can currently delete their own comment. In fact, we might want to consider refactoring that for comments, or even having a separate set of APIs for comments. That might also make it easier to refactor later, e.g. when we move to using channel threads. I'm out next week, so looping in @wiggin77 as an extra pair of eyes.
or even having a separate set of APIs for comments.
I'll review. In the meantime, +1 for dedicated API for comments. Will make it much easier to change how comments are stored later.
we may also need to check this for Delete Block, because a user can currently delete their own comment.
It would appear any user with board access can delete anyone else's comments via the DeleteBlock API.
we may also need to check this for Delete Block, because a user can currently delete their own comment.
It would appear any user with board access can delete anyone else's comments via the DeleteBlock API.
@wuwinson I chatted about this with @wiggin77 and we're good with creating a follow-up card to add logic to DeleteBlock since a user with board access can delete any comment ~~via the API directly~~.
edit: in more testing locally it appears it's more than just the API directly: as a Commenter I can delete any comments, even ones not my own. cc @jespino
@wuwinson I chatted about this with @jespino
Yes, that makes a lot of sense, actually, the comment should be handled in a specific way there, in my opinion, you shouldn't be able to delete comments in general, doesn't matter if you are an editor
I would expect that maybe, and admin, can delete comments
but not other editor, for example
additionally, I was reviewing the spec more and it makes mention of being able to edit comments which I didn't realize initially (editing doesn't exist right now)
@wuwinson I chatted about this with @jespino
Yes, that makes a lot of sense, actually, the comment should be handled in a specific way there, in my opinion, you shouldn't be able to delete comments in general, doesn't matter if you are an editor I would expect that maybe, and admin, can delete comments but not other editor, for example
additionally, I was reviewing the spec more and it makes mention of being able to edit comments which I didn't realize initially (editing doesn't exist right now)
@Pinjasaur Good catch! I updated the spec to remove the portion about editing comments since it's not supported yet. However, Commenters should be able to delete their own comments, but not others. This behavior would be consistent with Channels as well.
