@headless-lms/core 0.2.0 → 0.4.0

package/dist/discussion/service.js

@@ -1,8 +1,11 @@
-import { noopLogger } from "../shared/logger.js";
 import { genId } from "../shared/id.js";
-import { ForbiddenError, NotFoundError } from "../shared/errors.js";
+import { ConflictError, ForbiddenError, NotFoundError } from "../shared/errors.js";
+import { noopLogger } from "../shared/logger.js";
+import { canModerate, isStaffRole } from "../organizations/roles.js";
 import "../shared/settings.js";
 import { discussionEvents } from "./events.js";
+import { authorView } from "./authors.js";
+import { keepAllowed, mentionTokens, mentionViews } from "./mentions.js";
 //#region src/discussion/service.ts
 /** A course with no stored settings. Discussion is opt-in, so the common case
 *  persists no row at all and every existing course stays silent. */
@@ -17,15 +20,23 @@ var DiscussionServiceImpl = class {
 	repo;
 	access;
 	content;
+	posts;
+	spaces;
+	mentions;
 	uow;
 	settings;
+	fileUrls;
 	logger;
 	constructor(params) {
 		this.repo = params.repo;
 		this.access = params.access;
 		this.content = params.content;
+		this.posts = params.posts;
+		this.spaces = params.spaces;
+		this.mentions = params.mentions;
 		this.uow = params.uow;
 		this.settings = params.settings;
+		this.fileUrls = params.fileUrls;
 		this.logger = params.logger ?? noopLogger;
 	}
 	async resolveConfig(orgId, activityId) {
@@ -44,35 +55,27 @@ var DiscussionServiceImpl = class {
 			reactions: settings.reactions
 		};
 	}
-	/** Any org user that is not a learner moderates. The role arrives from
-	*  the edge already resolved; core never looks one up to authorise. */
 	isStaff(actor) {
-		return actor.role !== "student";
+		return isStaffRole(actor.role);
 	}
-	toAuthor(record) {
-		return {
-			id: record.id,
-			firstName: record.firstName,
-			lastName: record.lastName,
-			image: record.image,
-			role: record.role
-		};
-	}
-	toView(comment, authors, reactions) {
+	toView(orgId, comment, authors, urls, reactions, mentions) {
 		const author = authors[comment.orgUserId];
-		if (!author) throw new NotFoundError("OrgUser", comment.orgUserId);
-		if (comment.removedBy && !authors[comment.removedBy]) throw new NotFoundError("OrgUser", comment.removedBy);
+		if (!author) throw new NotFoundError("Member", comment.orgUserId);
+		if (comment.removedBy && !authors[comment.removedBy]) throw new NotFoundError("Member", comment.removedBy);
 		const remover = comment.removedBy ? authors[comment.removedBy] : void 0;
 		return {
 			id: comment.id,
 			activityId: comment.activityId,
+			postId: comment.postId,
+			communityId: comment.communityId,
 			parentId: comment.parentId,
-			author: this.toAuthor(author),
+			author: authorView(orgId, author, urls),
 			body: comment.status === "removed" ? null : comment.body,
 			status: comment.status,
-			removedBy: remover ? this.toAuthor(remover) : null,
+			removedBy: remover ? authorView(orgId, remover, urls) : null,
 			reactions: reactions.reactions,
 			viewerReaction: reactions.viewerReaction,
+			mentions: comment.status === "removed" ? [] : mentions,
 			createdAt: comment.createdAt,
 			updatedAt: comment.updatedAt
 		};
@@ -86,31 +89,75 @@ var DiscussionServiceImpl = class {
 		return [...ids];
 	}
 	async renderOne(orgId, comment, actor) {
-		const authors = await this.repo.authorsOf(orgId, this.peopleIn([comment]));
+		const [authors, mentioned] = await Promise.all([this.repo.authorsOf(orgId, this.peopleIn([comment])), mentionViews(this.mentions, this.repo, orgId, "comment", [comment.id])]);
 		const stored = comment.status === "removed" ? EMPTY_REACTIONS : (await this.repo.reactionsOf(orgId, [comment.id], actor.id))[comment.id] ?? EMPTY_REACTIONS;
-		return this.toView(comment, authors, stored);
+		return this.toView(orgId, comment, authors, this.fileUrls, stored, mentioned[comment.id] ?? []);
+	}
+	activityIdOf(comment) {
+		if (comment.activityId === null) throw new NotFoundError("Activity", comment.id);
+		return comment.activityId;
 	}
 	async hasAccess(orgId, activityId, actor) {
 		if (this.isStaff(actor)) return true;
 		const activity = await this.content.getActivity(orgId, activityId);
-		return activity ? this.access.hasCourseAccess(orgId, actor.id, activity.courseId) : false;
+		return activity ? this.access.hasAccess(orgId, actor.id, activity.courseId) : false;
+	}
+	async requireActivityOpen(orgId, activityId, actor) {
+		const activity = await this.content.getActivity(orgId, activityId);
+		if (!activity) throw new NotFoundError("Activity", activityId);
+		if (!this.isStaff(actor) && !await this.access.hasAccess(orgId, actor.id, activity.courseId)) throw new ForbiddenError("You cannot open this activity");
+		return activity;
+	}
+	async courseOpeners(orgId, courseId, orgUserIds) {
+		if (orgUserIds.length === 0) return [];
+		const people = await this.repo.authorsOf(orgId, orgUserIds);
+		const opens = await Promise.all(orgUserIds.map(async (orgUserId) => {
+			const person = people[orgUserId];
+			if (!person) return false;
+			return isStaffRole(person.role) || this.access.hasAccess(orgId, orgUserId, courseId);
+		}));
+		return orgUserIds.filter((_, index) => opens[index]);
+	}
+	async spaceOpeners(orgId, spaceId, orgUserIds) {
+		if (orgUserIds.length === 0) return [];
+		return keepAllowed(orgUserIds, await this.spaces.spaceOpenersAmong(orgId, spaceId, orgUserIds));
+	}
+	async openersOf(orgId, comment, orgUserIds) {
+		if (orgUserIds.length === 0) return [];
+		if (comment.postId) {
+			const post = await this.posts.find(orgId, comment.postId);
+			return post ? this.spaceOpeners(orgId, post.spaceId, orgUserIds) : [];
+		}
+		const activity = await this.content.getActivity(orgId, this.activityIdOf(comment));
+		return activity ? this.courseOpeners(orgId, activity.courseId, orgUserIds) : [];
+	}
+	commenterIds(orgId, target) {
+		return this.repo.commenterIds(orgId, target);
 	}
-	async postComment(orgId, { activityId, actor, parentId, body }) {
-		if (!await this.hasAccess(orgId, activityId, actor)) throw new ForbiddenError("no access to this activity");
+	async postComment(orgId, input) {
+		if (input.postId) return this.postOnPost(orgId, input.postId, input);
+		const activityId = input.activityId;
+		if (!activityId) throw new NotFoundError("Activity", activityId ?? "");
+		return this.postOnActivity(orgId, activityId, input);
+	}
+	async postOnActivity(orgId, activityId, { actor, parentId, body }) {
+		const activity = await this.requireActivityOpen(orgId, activityId, actor);
 		const config = await this.resolveConfig(orgId, activityId);
-		if (!config.enabled) throw new ForbiddenError("discussion is not open on this activity");
+		if (!config.enabled) throw new ForbiddenError("Discussion is not open on this activity");
 		if (parentId !== null) {
-			if (!config.threaded) throw new ForbiddenError("replies are disabled on this course");
+			if (!config.threaded) throw new ForbiddenError("Replies are off on this course");
 			const parent = await this.repo.findComment(orgId, parentId);
 			if (!parent || parent.activityId !== activityId) throw new NotFoundError("Comment", parentId);
-			if (parent.parentId !== null) throw new ForbiddenError("replies nest one level");
-			if (parent.status !== "published") throw new ForbiddenError("cannot reply to a comment that is not published");
+			if (parent.parentId !== null) throw new ForbiddenError("A reply cannot have replies of its own");
+			if (parent.status !== "published") throw new ForbiddenError("You can reply only to a published comment");
 		}
 		const status = config.requireReview && !this.isStaff(actor) ? "pending" : "published";
 		const comment = {
 			id: genId("comment"),
 			orgId,
 			activityId,
+			postId: null,
+			communityId: null,
 			parentId,
 			orgUserId: actor.id,
 			body,
@@ -119,56 +166,193 @@ var DiscussionServiceImpl = class {
 			createdAt: /* @__PURE__ */ new Date(),
 			updatedAt: /* @__PURE__ */ new Date()
 		};
+		const mentioned = await this.courseOpeners(orgId, activity.courseId, mentionTokens(body));
 		const saved = await this.uow.run(async (scope) => {
 			const row = await scope.discussion.insertComment(orgId, comment);
+			await scope.mentions.sync(orgId, "comment", row.id, mentioned, comment.createdAt);
 			await scope.outbox.append([discussionEvents.commentCreated.make({
 				orgId,
-				data: row
+				data: {
+					...row,
+					mentionedOrgUserIds: status === "published" ? mentioned : []
+				},
+				metadata: { actorOrgUserId: actor.id }
 			})]);
 			this.logger.info("comment created", {
 				orgId,
 				commentId: row.id,
-				status
+				status,
+				actorId: actor.id
 			});
 			return row;
 		});
 		return this.renderOne(orgId, saved, actor);
 	}
+	async postOnPost(orgId, postId, { actor, parentId, body }) {
+		const { post, space } = await this.visiblePost(orgId, actor, postId);
+		if (post.status !== "published") throw new ConflictError("This post is not published");
+		if (!this.commentsOpen(post, space)) throw new ForbiddenError("Comments are closed on this post");
+		if (parentId !== null) {
+			const parent = await this.repo.findComment(orgId, parentId);
+			if (!parent || parent.postId !== postId) throw new NotFoundError("Comment", parentId);
+			if (parent.parentId !== null) throw new ForbiddenError("A reply cannot have replies of its own");
+			if (parent.status !== "published") throw new ForbiddenError("You can reply only to a published comment");
+		}
+		const now = /* @__PURE__ */ new Date();
+		const comment = {
+			id: genId("comment"),
+			orgId,
+			activityId: null,
+			postId,
+			communityId: post.communityId,
+			parentId,
+			orgUserId: actor.id,
+			body,
+			status: "published",
+			removedBy: null,
+			createdAt: now,
+			updatedAt: now
+		};
+		const mentioned = await this.spaceOpeners(orgId, post.spaceId, mentionTokens(body));
+		const saved = await this.uow.run(async (scope) => {
+			const row = await scope.discussion.insertComment(orgId, comment);
+			await scope.mentions.sync(orgId, "comment", row.id, mentioned, now);
+			await scope.outbox.append([discussionEvents.commentCreated.make({
+				orgId,
+				data: {
+					...row,
+					mentionedOrgUserIds: mentioned
+				},
+				metadata: { actorOrgUserId: actor.id }
+			})]);
+			this.logger.info("comment created", {
+				orgId,
+				commentId: row.id,
+				postId,
+				status: "published",
+				actorId: actor.id
+			});
+			return row;
+		});
+		return this.renderOne(orgId, saved, actor);
+	}
+	async postComments(orgId, postId, actor, query) {
+		const { post, space } = await this.visiblePost(orgId, actor, postId);
+		const seesHeld = (person) => this.canModerate(person);
+		const page = await this.repo.listThreadsByPost(orgId, postId, {
+			...query,
+			viewerId: actor.id,
+			seesHeld: seesHeld(actor)
+		});
+		const comments = await this.thread(orgId, page.rows, actor, post.reactionsEnabled ?? space.settings.reactions, seesHeld);
+		this.logger.debug("post comments read", {
+			orgId,
+			postId,
+			count: comments.length
+		});
+		return {
+			...page,
+			rows: comments
+		};
+	}
+	async thread(orgId, rows, actor, reactionsOn, seesHeld) {
+		const readable = rows.filter((comment) => {
+			if (comment.status === "published" || comment.status === "removed") return true;
+			return seesHeld(actor) || comment.orgUserId === actor.id;
+		});
+		const replies = readable.filter((comment) => comment.parentId !== null && comment.status !== "removed");
+		const heldOpen = new Set(replies.map((reply) => reply.parentId));
+		const roots = readable.filter((comment) => comment.parentId === null && (comment.status !== "removed" || heldOpen.has(comment.id)));
+		const rootIds = new Set(roots.map((root) => root.id));
+		const served = [...roots, ...replies.filter((reply) => rootIds.has(reply.parentId))].sort((a, b) => a.createdAt.getTime() - b.createdAt.getTime());
+		const [authors, reactions, mentioned] = await Promise.all([
+			this.repo.authorsOf(orgId, this.peopleIn(served)),
+			reactionsOn ? this.repo.reactionsOf(orgId, served.map((comment) => comment.id), actor.id) : Promise.resolve({}),
+			mentionViews(this.mentions, this.repo, orgId, "comment", served.map((comment) => comment.id))
+		]);
+		const urls = this.fileUrls;
+		return served.map((comment) => this.toView(orgId, comment, authors, urls, reactions[comment.id] ?? EMPTY_REACTIONS, mentioned[comment.id] ?? []));
+	}
+	async visiblePost(orgId, actor, postId) {
+		return this.posts.visible(orgId, actor, postId);
+	}
+	async postOfComment(orgId, actor, commentId, postId) {
+		try {
+			return await this.visiblePost(orgId, actor, postId);
+		} catch (error) {
+			if (error instanceof NotFoundError) throw new NotFoundError("Comment", commentId);
+			throw error;
+		}
+	}
+	canModerate(actor) {
+		return canModerate(actor.role);
+	}
+	inCommunity(comment, communityId) {
+		return communityId === void 0 || comment.communityId === communityId;
+	}
+	commentsOpen(post, space) {
+		return post.commentsClosed === null ? space.settings.comments : !post.commentsClosed;
+	}
 	async activityComments(orgId, activityId, actor) {
+		await this.requireActivityOpen(orgId, activityId, actor);
 		const config = await this.resolveConfig(orgId, activityId);
 		if (!config.enabled) return {
 			config,
 			comments: []
 		};
-		const readable = (await this.repo.listByActivity(orgId, activityId)).filter((c) => {
-			if (c.status === "published" || c.status === "removed") return true;
-			return this.isStaff(actor) || c.orgUserId === actor.id;
-		});
-		const replies = readable.filter((c) => c.parentId !== null && c.status !== "removed");
-		const heldOpen = new Set(replies.map((r) => r.parentId));
-		const roots = readable.filter((c) => c.parentId === null && (c.status !== "removed" || heldOpen.has(c.id)));
-		const rootIds = new Set(roots.map((r) => r.id));
-		const served = [...roots, ...replies.filter((r) => rootIds.has(r.parentId))].sort((a, b) => a.createdAt.getTime() - b.createdAt.getTime());
-		const [authors, reactions] = await Promise.all([this.repo.authorsOf(orgId, this.peopleIn(served)), config.reactions ? this.repo.reactionsOf(orgId, served.map((c) => c.id), actor.id) : Promise.resolve({})]);
+		const rows = await this.repo.listByActivity(orgId, activityId);
 		return {
 			config,
-			comments: served.map((c) => this.toView(c, authors, reactions[c.id] ?? EMPTY_REACTIONS))
+			comments: await this.thread(orgId, rows, actor, config.reactions, (person) => this.isStaff(person))
 		};
 	}
 	async edit(orgId, commentId, actor, body) {
 		const { comment, config } = await this.loadWithConfig(orgId, commentId, actor);
-		if (!config.enabled) throw new ForbiddenError("discussion is not open on this activity");
-		if (comment.orgUserId !== actor.id) throw new ForbiddenError("only the author may edit a comment");
-		if (comment.status === "removed") throw new ForbiddenError("a removed comment cannot be edited");
-		const updated = await this.repo.updateComment(orgId, commentId, { body });
-		if (!updated) throw new NotFoundError("Comment", commentId);
+		if (!config.enabled) throw new ForbiddenError(comment.postId ? "Comments are closed on this post" : "Discussion is not open on this activity");
+		if (comment.orgUserId !== actor.id) throw new ForbiddenError("You can edit only your own comment");
+		if (comment.status === "removed") throw new ForbiddenError("A removed comment cannot be edited");
+		const candidates = await this.openersOf(orgId, comment, mentionTokens(body));
+		const updated = await this.uow.run(async (scope) => {
+			const next = await scope.discussion.updateComment(orgId, commentId, { body });
+			if (!next) throw new NotFoundError("Comment", commentId);
+			const added = await scope.mentions.sync(orgId, "comment", commentId, candidates, /* @__PURE__ */ new Date());
+			await scope.outbox.append([discussionEvents.commentUpdated.make({
+				orgId,
+				data: {
+					...next,
+					mentionedOrgUserIds: next.status === "published" ? keepAllowed(candidates, added) : []
+				},
+				metadata: { actorOrgUserId: actor.id }
+			})]);
+			return next;
+		});
+		this.logger.info("comment edited", {
+			orgId,
+			commentId,
+			actorId: actor.id
+		});
 		return this.renderOne(orgId, updated, actor);
 	}
-	async remove(orgId, commentId, actor) {
+	async remove(orgId, commentId, actor, communityId) {
+		return this.renderOne(orgId, await this.removeComment(orgId, commentId, actor, communityId), actor);
+	}
+	async removeComment(orgId, commentId, actor, communityId) {
 		const comment = await this.getComment(orgId, commentId);
-		if (!comment) throw new NotFoundError("Comment", commentId);
-		if (!await this.hasAccess(orgId, comment.activityId, actor)) throw new ForbiddenError("no access to this activity");
-		if (comment.orgUserId !== actor.id && !this.isStaff(actor)) throw new ForbiddenError("only the author or a moderator may remove a comment");
+		if (!comment || !this.inCommunity(comment, communityId)) {
+			this.logger.warn("comment remove rejected — not found", {
+				orgId,
+				commentId,
+				actorId: actor.id
+			});
+			throw new NotFoundError("Comment", commentId);
+		}
+		if (comment.postId) {
+			await this.postOfComment(orgId, actor, commentId, comment.postId);
+			if (comment.orgUserId !== actor.id && !this.canModerate(actor)) throw new ForbiddenError("You cannot remove this comment");
+		} else {
+			if (!await this.hasAccess(orgId, this.activityIdOf(comment), actor)) throw new ForbiddenError("You cannot open this activity");
+			if (comment.orgUserId !== actor.id && !this.isStaff(actor)) throw new ForbiddenError("You cannot remove this comment");
+		}
 		if (comment.status === "removed") return comment;
 		return this.uow.run(async (scope) => {
 			const updated = await scope.discussion.updateComment(orgId, commentId, {
@@ -176,28 +360,49 @@ var DiscussionServiceImpl = class {
 				removedBy: actor.id
 			});
 			if (!updated) throw new NotFoundError("Comment", commentId);
+			if (comment.orgUserId !== actor.id) await scope.discussion.resolveReportsFor(orgId, commentId, {
+				resolvedAt: /* @__PURE__ */ new Date(),
+				resolvedBy: actor.id,
+				resolution: "removed"
+			});
 			await scope.outbox.append([discussionEvents.commentRemoved.make({
 				orgId,
-				data: updated
+				data: updated,
+				metadata: { actorOrgUserId: actor.id }
 			})]);
 			this.logger.info("comment removed", {
 				orgId,
 				commentId,
-				by: actor.id
+				actorId: actor.id
 			});
 			return updated;
 		});
 	}
-	async restore(orgId, commentId, actor) {
-		if (!this.isStaff(actor)) throw new ForbiddenError("only a moderator may restore a comment");
+	async restore(orgId, commentId, actor, communityId) {
+		return this.renderOne(orgId, await this.restoreComment(orgId, commentId, actor, communityId), actor);
+	}
+	async restoreComment(orgId, commentId, actor, communityId) {
+		if (!this.isStaff(actor)) throw new ForbiddenError("You cannot restore this comment");
 		const comment = await this.getComment(orgId, commentId);
-		if (!comment) throw new NotFoundError("Comment", commentId);
+		if (!comment || !this.inCommunity(comment, communityId)) {
+			this.logger.warn("comment restore rejected — not found", {
+				orgId,
+				commentId,
+				actorId: actor.id
+			});
+			throw new NotFoundError("Comment", commentId);
+		}
 		if (comment.status !== "removed") return comment;
 		const updated = await this.repo.updateComment(orgId, commentId, {
 			status: "published",
 			removedBy: null
 		});
 		if (!updated) throw new NotFoundError("Comment", commentId);
+		this.logger.info("comment restored", {
+			orgId,
+			commentId,
+			actorId: actor.id
+		});
 		return updated;
 	}
 	/** Load a comment together with its activity's resolved comments config,
@@ -206,35 +411,78 @@ var DiscussionServiceImpl = class {
 	async loadWithConfig(orgId, commentId, actor) {
 		const comment = await this.getComment(orgId, commentId);
 		if (!comment) throw new NotFoundError("Comment", commentId);
-		if (!await this.hasAccess(orgId, comment.activityId, actor)) throw new ForbiddenError("no access to this activity");
+		if (comment.postId) {
+			const { post, space } = await this.postOfComment(orgId, actor, commentId, comment.postId);
+			return {
+				comment,
+				config: {
+					enabled: this.commentsOpen(post, space),
+					threaded: true,
+					requireReview: false,
+					reactions: post.reactionsEnabled ?? space.settings.reactions
+				},
+				spaceId: post.spaceId
+			};
+		}
+		const activityId = this.activityIdOf(comment);
+		if (!await this.hasAccess(orgId, activityId, actor)) throw new ForbiddenError("You cannot open this activity");
 		return {
 			comment,
-			config: await this.resolveConfig(orgId, comment.activityId)
+			config: await this.resolveConfig(orgId, activityId),
+			spaceId: null
 		};
 	}
 	async setReaction(orgId, commentId, actor, emoji) {
-		const { comment, config } = await this.loadWithConfig(orgId, commentId, actor);
-		if (!config.enabled) throw new ForbiddenError("discussion is not open on this activity");
-		if (!config.reactions && emoji !== null) throw new ForbiddenError("reactions are disabled on this course");
-		if (comment.status === "removed") throw new ForbiddenError("a removed comment cannot be reacted to");
-		await this.repo.setReaction(orgId, commentId, actor.id, emoji);
+		const { comment, config, spaceId } = await this.loadWithConfig(orgId, commentId, actor);
+		if (!config.enabled && !comment.postId) throw new ForbiddenError("Discussion is not open on this activity");
+		if (!config.reactions && emoji !== null) throw new ForbiddenError(comment.postId ? "Reactions are off on this post" : "Reactions are off on this course");
+		if (comment.status === "removed") throw new ForbiddenError("A removed comment cannot be reacted to");
+		await this.uow.run(async (scope) => {
+			if (!await scope.discussion.setReaction(orgId, commentId, actor.id, emoji) || emoji === null) return;
+			await scope.outbox.append([discussionEvents.commentReactionAdded.make({
+				orgId,
+				data: {
+					commentId,
+					postId: comment.postId,
+					activityId: comment.activityId,
+					spaceId,
+					communityId: comment.communityId,
+					orgUserId: actor.id,
+					reaction: emoji
+				},
+				metadata: { actorOrgUserId: actor.id }
+			})]);
+		});
 		return (await this.repo.reactionsOf(orgId, [commentId], actor.id))[commentId] ?? EMPTY_REACTIONS;
 	}
 	async approve(orgId, commentId, actor) {
-		if (!this.isStaff(actor)) throw new ForbiddenError("only a moderator may approve a comment");
+		if (!this.isStaff(actor)) throw new ForbiddenError("You cannot approve this comment");
 		const comment = await this.getComment(orgId, commentId);
-		if (!comment) throw new NotFoundError("Comment", commentId);
-		if (comment.status !== "pending") throw new ForbiddenError("only a pending comment can be approved");
+		if (!comment) {
+			this.logger.warn("comment approve rejected — not found", {
+				orgId,
+				commentId,
+				actorId: actor.id
+			});
+			throw new NotFoundError("Comment", commentId);
+		}
+		if (comment.status !== "pending") throw new ForbiddenError("Only a comment awaiting review can be approved");
 		return this.uow.run(async (scope) => {
 			const updated = await scope.discussion.updateComment(orgId, commentId, { status: "published" });
 			if (!updated) throw new NotFoundError("Comment", commentId);
+			const mentioned = await this.openersOf(orgId, updated, await scope.mentions.ofItem(orgId, "comment", commentId));
 			await scope.outbox.append([discussionEvents.commentPublished.make({
 				orgId,
-				data: updated
+				data: {
+					...updated,
+					mentionedOrgUserIds: mentioned
+				},
+				metadata: { actorOrgUserId: actor.id }
 			})]);
 			this.logger.info("comment published", {
 				orgId,
-				commentId
+				commentId,
+				actorId: actor.id
 			});
 			return updated;
 		});
@@ -243,26 +491,49 @@ var DiscussionServiceImpl = class {
 	*  caller must not decide that itself. `approve` and `restore` still enforce
 	*  their own staff check; the check here covers the third path, where a
 	*  comment is already published and neither of them would run. */
-	async publish(orgId, commentId, actor) {
-		if (!this.isStaff(actor)) throw new ForbiddenError("only a moderator may publish a comment");
+	async publish(orgId, commentId, actor, communityId) {
+		if (!this.isStaff(actor)) throw new ForbiddenError("You cannot publish this comment");
 		const comment = await this.getComment(orgId, commentId);
-		if (!comment) throw new NotFoundError("Comment", commentId);
+		if (!comment || !this.inCommunity(comment, communityId)) {
+			this.logger.warn("comment publish rejected — not found", {
+				orgId,
+				commentId,
+				actorId: actor.id
+			});
+			throw new NotFoundError("Comment", commentId);
+		}
 		if (comment.status === "pending") return this.approve(orgId, commentId, actor);
-		if (comment.status === "removed") return this.restore(orgId, commentId, actor);
+		if (comment.status === "removed") return this.restoreComment(orgId, commentId, actor);
 		return comment;
 	}
-	async resolveReports(orgId, commentId, actor) {
-		if (!this.isStaff(actor)) throw new ForbiddenError("only a moderator may resolve a report");
-		if (!await this.getComment(orgId, commentId)) throw new NotFoundError("Comment", commentId);
-		await this.repo.resolveReportsFor(orgId, commentId, /* @__PURE__ */ new Date());
+	async resolveReports(orgId, commentId, actor, communityId) {
+		const comment = await this.getComment(orgId, commentId);
+		if (!comment || !this.inCommunity(comment, communityId)) {
+			this.logger.warn("comment reports resolve rejected — not found", {
+				orgId,
+				commentId,
+				actorId: actor.id
+			});
+			throw new NotFoundError("Comment", commentId);
+		}
+		if (comment.postId) {
+			await this.postOfComment(orgId, actor, commentId, comment.postId);
+			if (!this.canModerate(actor)) throw new ForbiddenError("You cannot work this queue");
+		} else if (!this.isStaff(actor)) throw new ForbiddenError("You cannot resolve this report");
+		await this.repo.resolveReportsFor(orgId, commentId, {
+			resolvedAt: /* @__PURE__ */ new Date(),
+			resolvedBy: actor.id,
+			resolution: "dismissed"
+		});
 		this.logger.info("comment reports resolved", {
 			orgId,
-			commentId
+			commentId,
+			actorId: actor.id
 		});
 	}
 	async reportComment(orgId, commentId, actor, reason) {
-		const { config } = await this.loadWithConfig(orgId, commentId, actor);
-		if (!config.enabled) throw new ForbiddenError("discussion is not open on this activity");
+		const { comment, config } = await this.loadWithConfig(orgId, commentId, actor);
+		if (!config.enabled && !comment.postId) throw new ForbiddenError("Discussion is not open on this activity");
 		const now = /* @__PURE__ */ new Date();
 		const report = {
 			id: genId("commentReport"),
@@ -271,6 +542,8 @@ var DiscussionServiceImpl = class {
 			orgUserId: actor.id,
 			reason,
 			resolvedAt: null,
+			resolution: null,
+			resolvedBy: null,
 			createdAt: now,
 			updatedAt: now
 		};
@@ -283,11 +556,16 @@ var DiscussionServiceImpl = class {
 			}
 			await scope.outbox.append([discussionEvents.commentReported.make({
 				orgId,
-				data: saved
+				data: {
+					...saved,
+					communityId: comment.communityId
+				},
+				metadata: { actorOrgUserId: actor.id }
 			})]);
 			this.logger.info("comment reported", {
 				orgId,
-				commentId
+				commentId,
+				actorId: actor.id
 			});
 			return saved;
 		});
@@ -301,29 +579,30 @@ var DiscussionServiceImpl = class {
 		};
 		const reports = await this.repo.listOpenReports(orgId, rows.map((c) => c.id));
 		const authors = await this.repo.authorsOf(orgId, [.../* @__PURE__ */ new Set([...this.peopleIn(rows), ...reports.map((r) => r.orgUserId)])]);
+		const urls = this.fileUrls;
 		const byComment = /* @__PURE__ */ new Map();
 		for (const report of reports) byComment.set(report.commentId, [...byComment.get(report.commentId) ?? [], report]);
 		return {
 			...page,
 			rows: page.rows.map(({ comment, courseId, activityTitle }) => {
 				const author = authors[comment.orgUserId];
-				if (!author) throw new NotFoundError("OrgUser", comment.orgUserId);
+				if (!author) throw new NotFoundError("Member", comment.orgUserId);
 				return {
 					id: comment.id,
 					parentId: comment.parentId,
-					activityId: comment.activityId,
+					activityId: this.activityIdOf(comment),
 					activityTitle,
 					courseId,
 					body: comment.body,
 					status: comment.status,
-					author: this.toAuthor(author),
+					author: authorView(orgId, author, urls),
 					authorEmail: author.email,
 					removedBy: comment.removedBy,
 					reports: (byComment.get(comment.id) ?? []).map((r) => {
 						const reporter = authors[r.orgUserId];
-						if (!reporter) throw new NotFoundError("OrgUser", r.orgUserId);
+						if (!reporter) throw new NotFoundError("Member", r.orgUserId);
 						return {
-							reporter: this.toAuthor(reporter),
+							reporter: authorView(orgId, reporter, urls),
 							reason: r.reason,
 							createdAt: r.createdAt
 						};