strapi-plugin-comments 2.0.0-rc.1 → 2.0.0-rc.2

package/README.md

@@ -1,9 +1,11 @@
-<div align="center">
+<div align="center" width="150px">
   <img style="width: 150px; height: auto;" src="public/assets/logo.png" alt="Logo - Strapi Comments plugin" />
+</div>
+<div align="center">
   <h1>Strapi v4 - Comments plugin</h1>
   <p>Powerfull Strapi based comments moderation tool for you and your users</p>
   <a href="https://www.npmjs.org/package/strapi-plugin-comments">
-    <img src="https://img.shields.io/npm/v/strapi-plugin-comments/latest.svg" alt="NPM Version" />
+    <img alt="GitHub package.json version" src="https://img.shields.io/github/package-json/v/VirtusLab-Open-Source/strapi-plugin-comments?label=npm&logo=npm">
   </a>
   <a href="https://www.npmjs.org/package/strapi-plugin-comments">
     <img src="https://img.shields.io/npm/dm/strapi-plugin-comments.svg" alt="Monthly download on NPM" />
@@ -76,7 +78,7 @@ In our minimum support we're following [official Node.js releases timelines](htt
 
 **Supported Strapi versions**:
 
-- Strapi v4.0.5 (recently tested)
+- Strapi v4.0.6 (recently tested)
 - Strapi v4.x
 
 > This plugin is designed for **Strapi v4** and is not working with v3.x. To get version for **Strapi v3** install version [v1.x](https://github.com/VirtusLab-Open-Source/strapi-plugin-comments/tree/strapi-v3).
@@ -101,6 +103,9 @@ To setup amend default plugin configuration we recommend to put following snippe
             reportReasons: {
                 'MY_CUSTOM_REASON': 'MY_CUSTOM_REASON',
             },
+            gql: { 
+              // ...
+            },
         },
         //...
     });
@@ -112,12 +117,36 @@ To setup amend default plugin configuration we recommend to put following snippe
 - `approvalFlow` - list of Content Types which are supporting approval flow. Values must be in format like `'api::<collection name>.<content type name>'`. For not included, posted comments are going to be immediately visible. 
 - `entryLabel` - ordered list of property names per Content Type to generate related entity label. Keys must be in format like `'api::<collection name>.<content type name>'`. Default formatting set as `*`.
 - `reportReasons` - set of enums you would like to use for issuing abuse reports. Provided by default `'BAD_LANGUAGE'`, `'DISCRIMINATION'` and `'OTHER'`.
+- `gql` - specific configuration for GraphQL. See [Additional GQL Configuration](#additional-gql-configuration)
 
 ## Additional GQL Configuration
-All you need to do is to install and enable `@strapi/plugin-graphql` for you instance based on the **[official Strapi v4 docs](https://docs.strapi.io/developer-docs/latest/plugins/graphql.html#configurations)**.
+All you need to do is to install and enable `@strapi/plugin-graphql` for you instance based on the **[official Strapi v4 docs](https://docs.strapi.io/developer-docs/latest/plugins/graphql.html#configurations)** and decide if you would like to call it by anyone (open for world) or only by authenticated users (Strapi users).
+
+```json
+  {
+    // ...
+    gql: {
+      auth: true, // Default: false
+    },
+    // ...
+  }
+```
+
+### Properties
+- `auth` - does GraphQL Queries should be authenticated or not? Default: `false`
+
+### Queries
 
 See [available GQL specification section](#public-graphql-specification).
 
+>  If `auth` is set to `true` you must provide relevant authentication headers to all requests like for example:
+>  
+> ```json
+> {
+>  "Authorization": "Bearer <your token here>"
+> }
+> ```
+
 ## 👤 RBAC
 Plugin provides granular permissions based on Strapi RBAC functionality.
 
@@ -134,7 +163,6 @@ Feature / Capability focused permissions:
 
 ## Base Comment model
 
-### Generic (non Strapi User)
 ```json
 {
     "id": 1,
@@ -146,8 +174,8 @@ Feature / Capability focused permissions:
     "removed": null,
     "approvalStatus": "APPROVED", // Only in case of enabled approval flow. Default: null
     "author": {
-        "id": "207ccfdc-94ba-45eb-979c-790f6f49c392",
-        "name": "Joe Doe",
+        "id": "207ccfdc-94ba-45eb-979c-790f6f49c392", // For Strapi users id reflects to the format used by your Strapi
+        "name": "Joe Doe", // For Strapi users it is equal to 'username' field
         "email": "jdoe@sample.com",
         "avatar": null,
     },
@@ -156,47 +184,18 @@ Feature / Capability focused permissions:
     "related": {}, // Related content type entity
     "reports": [] // Reports issued against this comment
 }
-```
-### Strapi User
-```json
-{
-    "id": 1,
-    "content": "My comment content",
-    "blocked": true,
-    "blockedThread": null,
-    "blockReason": null,
-    "removed": null,
-    "approvalStatus": "REJECTED", // Only in case of enabled approval flow. Default: null
-    "authorUser": {
-        "id": 1,
-        "username": "Sample User",
-        "email": "user@sample.com",
-        "provider": "local",
-        "confirmed": true,
-        "blocked": false,
-        "role": 1,
-        "created_at": "2020-07-10T08:38:03.157Z",
-        "updated_at": "2020-07-10T08:38:03.170Z"
-    },
-    "authorId": null,
-    "authorName": null,
-    "authorEmail": null,
-    "authorAvatar": null,
-    "createdAt": "2020-07-14T20:13:01.649Z",
-    "updatedAt": "2020-07-14T20:13:01.670Z",
-    "related": {}, // Related content type entity
-    "reports": [] // Reports issued against this comment
-}
-
 ```
 
 ## 🕸️ Public REST API specification
 
+**Strapi Users vs. Generic authors**
+> Keep in mind that if you're using auth / authz your requests to setup proper user contexts it has got higher priority in order to take author data comparing to `author` property provided as part of your payload.
+
 ### Get Comments
 
 *GraphQL equivalent: [Public GraphQL API -> Get Comments](#get-comments-1)*
 
-`GET <host>/comments/api::<collection name>.<content type name>:<entity id>`
+`GET <host>/api/comments/api::<collection name>.<content type name>:<entity id>`
 
 Return a hierarchical tree structure of comments for specified instance of Content Type like for example `Page` with `ID: 1`
 
@@ -226,7 +225,7 @@ Return a hierarchical tree structure of comments for specified instance of Conte
 
 *GraphQL equivalent: [Public GraphQL API -> Get Comments (flat structure)](#get-comments-flat-structure-1)*
 
-`GET <host>/comments/api::<collection name>.<content type name>:<entity id>/flat`
+`GET <host>/api/comments/api::<collection name>.<content type name>:<entity id>/flat`
 
 Return a flat structure of comments for specified instance of Content Type like for example `Page` with `ID: 1`
 
@@ -254,7 +253,7 @@ Return a flat structure of comments for specified instance of Content Type like
 
 *GraphQL equivalent: [Public GraphQL API -> Post a Comments](#post-a-comment-1)*
 
-`POST <host>/comments/api::<collection name>.<content type name>:<entity id>`
+`POST <host>/api/comments/api::<collection name>.<content type name>:<entity id>`
 
 Posts a Comment related to specified instance of Content Type like for example `Page` with `ID: 1`
 
@@ -265,21 +264,23 @@ Posts a Comment related to specified instance of Content Type like for example `
 *Generic (non Strapi User)*
 ```json
 {
-    "author": {
-        "id": "<any ID like value>",
-        "name": "Joe Doe",
-        "email": "jdoe@sample.com",
-        "avatar": "<any image url>"
-    },
+  "author": {
+      "id": "<any ID like value>",
+      "name": "Joe Doe",
+      "email": "jdoe@sample.com",
+      "avatar": "<any image url>"
+  },
 	"content": "My sample response",
 	"threadOf": 2, // id of comment we would like to start / continue the thread (Optional)
 }
 ```
 
 *Strapi user*
+
+> Author is taken directly from the request context
+
 ```json
 {
-	"authorUser": 1, // id of a author user. Optional in case of 'enableUsers: true' in the plugin configuration
 	"content": "My sample response",
 	"threadOf": 2, // id of comment we would like to start / continue the thread (Optional)
 }
@@ -301,7 +302,7 @@ Posts a Comment related to specified instance of Content Type like for example `
 
 *GraphQL equivalent: [Public GraphQL API -> Update Comments](#update-comment-1)*
 
-`PUT <host>/comments/api::<collection name>.<content type name>:<entity id>/comment/<commentId>`
+`PUT <host>/api/comments/api::<collection name>.<content type name>:<entity id>/comment/<commentId>`
 
 Updates a specified Comment content based on it `commentId` and related to specified instance of Content Type like for example `Page` with `ID: 1`
 
@@ -312,17 +313,19 @@ Updates a specified Comment content based on it `commentId` and related to speci
 *Generic (non Strapi User)*
 ```json
 {
-    "author": {
-        "id": "<any ID like value>"
-    },
+  "author": {
+      "id": "<any ID like value>"
+  },
 	"content": "My sample response"
 }
 ```
 
 *Strapi user*
+
+> Author is taken directly from the request context
+
 ```json
 {
-	"authorUser": 1, // id of a author user. Optional in case of 'enableUsers: true' in the plugin configuration
 	"content": "My sample response"
 }
 ```
@@ -344,7 +347,7 @@ Updates a specified Comment content based on it `commentId` and related to speci
 
 *GraphQL equivalent: [Public GraphQL API -> Delete Comment](#delete-comment-1)*
 
-`DELETE <host>/comments/api::<collection name>.<content type name>:<entity id>/<commentId>?authorId=<authorId>`
+`DELETE <host>/api/comments/api::<collection name>.<content type name>:<entity id>/<commentId>?authorId=<authorId>`
 
 Deletes a specified Comment based on it `commentId` and related to specified instance of Content Type like for example `Page` with `ID: 1`.
 
@@ -367,7 +370,7 @@ Deletes a specified Comment based on it `commentId` and related to specified ins
 
 *GraphQL equivalent: [Public GraphQL API -> Issue Abuse Report against specified Comment](#issue-abuse-report-against-specified-comment-1)*
 
-`POST <host>/comments/api::<collection name>.<content type name>:<entity id>/comment/<commentId>/report-abuse`
+`POST <host>/api/comments/api::<collection name>.<content type name>:<entity id>/comment/<commentId>/report-abuse`
 
 Reports abuse in specified Comment content based on it `commentId` and related to specified instance of Content Type like for example `Page` with `ID: 1` and requests moderator attention.
 
@@ -398,7 +401,11 @@ Reports abuse in specified Comment content based on it `commentId` and related t
 
 ## 🕸️ Public GraphQL specification
 
-> *To test all queries and understand the schemas use GraphQL Playground exposed by `@strapi/plugin-graphql` on `http://localhost:1337/graphql`*
+**Strapi Users vs. Generic authors**
+> Keep in mind that if you're using auth / authz your requests to setup proper user contexts it has got higher priority in order to take author data comparing to `author` property provided as part of your payload.
+
+**Testing**
+> To test all queries and understand the schemas use GraphQL Playground exposed by `@strapi/plugin-graphql` on `http://localhost:1337/graphql`
 
 ### Get Comments
 
@@ -516,7 +523,7 @@ mutation createComment {
       relation: "api::page.page:1"
       content: "Hello World!"
       threadOf: 3
-      author: { id: "12345678", name: "John Wick", email: "test@test.pl" }
+      author: { id: "12345678", name: "John Wick", email: "test@test.pl" } # Optional if using auth / authz requests
     }
   ) {
     id
@@ -565,7 +572,7 @@ mutation updateComment {
       id: 34
       relation: "api::page.page:1"
       content: "I've changed it!"
-      author: { id: "12345678" }
+      author: { id: "12345678" } # Optional if using auth / authz requests
     }
   ) {
     id
@@ -614,7 +621,11 @@ mutation updateComment {
 ```graphql
 mutation removeComment {
   removeComment(
-    input: { id: 33, relation: "api::page.page:1", author: { id: "12345678" } }
+    input: { 
+      id: 33, 
+      relation: "api::page.page:1", 
+      author: { id: "12345678" } # Optional if using auth / authz requests
+    }
   ) {
     id
     removed

package/admin/src/components/DiscussionThread/index.js

@@ -37,7 +37,7 @@ const DiscussionThread = ({ level = [], selected = {}, allowedActions, isReloadi
             { rootThread && (<DiscussionThreadItem {...rootThread} allowedActions={allowedActions} isThreadAuthor root pinned />) }
             { level.map(item => {
                 const isSelected = selected.id === item.id;
-                const isThreadAuthor = !isNil(selected?.threadOf?.authorId) && (selected?.threadOf?.authorId === item.authorId);
+                const isThreadAuthor = !isNil(selected?.threadOf?.author?.id) && (selected?.threadOf?.author?.id === item?.author?.id);
                 return (<DiscussionThreadItem 
                     key={`comment-${item.id}`}
                     {...item} 

package/admin/src/components/DiscussionThreadItem/index.js

@@ -32,8 +32,7 @@ const DiscussionThreadItem = (props) => {
         blockedThread, 
         gotThread, 
         threadFirstItemId, 
-        authorUser, 
-        author } = props;
+        author = {} } = props;
 
     let background = 'neutral100';
     let borderColor = 'neutral200';
@@ -57,8 +56,7 @@ const DiscussionThreadItem = (props) => {
         StyledComponent = DiscussionThreadItemRoot;
     }
 
-    const avatar = author?.avatar || authorUser?.avatar;
-    const name = author?.name || `${authorUser?.firstName} ${authorUser?.lastName}`;
+    const { name, avatar } = author;
     const isBlocked = blocked || blockedThread;
     
     return (<StyledComponent as="li">

package/content-types/comment.js

@@ -48,10 +48,6 @@ module.exports = {
       target: 'plugin::users-permissions.user',
       configurable: false,
     },
-    authorType: {
-      type: 'string',
-      configurable: false
-    },
     authorId: {
       type: 'string',
       configurable: false

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "strapi-plugin-comments",
-  "version": "2.0.0-rc.1",
+  "version": "2.0.0-rc.2",
   "description": "Strapi - Comments plugin",
   "strapi": {
     "name": "comments",
@@ -8,6 +8,7 @@
     "kind": "plugin"
   },
   "scripts": {
+    "publish": "npm publish --tag latest",
     "test:unit": "jest --verbose --coverage"
   },
   "repository": {
@@ -15,8 +16,8 @@
     "url": "https://github.com/VirtusLab-Open-Source/strapi-plugin-comments"
   },
   "dependencies": {
-    "@strapi/utils": "^4.0.5",
-    "@strapi/plugin-graphql": "^4.0.5",
+    "@strapi/utils": "^4.0.6",
+    "@strapi/plugin-graphql": "^4.0.6",
     "bad-words": "^3.0.4"
   },
   "devDependencies": {

package/server/controllers/client.js

@@ -82,14 +82,19 @@ module.exports = {
   },
 
   async removeComment(ctx) {
-    const { params: { relationId, commentId }, query: { authorId } } = ctx;
-    if (authorId) {
+    const { 
+      params: { relationId, commentId }, 
+      query: { authorId },
+      state: { user },
+    } = ctx;
+    if (authorId || user?.id) {
       try {
         return await this.getService()
           .markAsRemoved(
             commentId,
             relationId,
             authorId,
+            user
           );
       } catch (e) {
         if (!e.isBoom) {

package/server/controllers/utils/parsers.js

@@ -9,7 +9,9 @@ module.exports = {
               related: relation,
             },
             populate: {
-              threadOf: true,
+              threadOf: {
+                populate: { authorUser: true },
+              },
             },
           };
     },

package/server/graphql/mutations/createAbuseReport.js

@@ -10,11 +10,16 @@ module.exports = ({ nexus }) => {
 		args: {
 			input: nonNull('CreateReport'),
 		},
-		async resolve(obj, args) {
+		async resolve(obj, args, ctx) {
 			const { input } = args;
+			const { state: { user } = {} } = ctx;
 			const { commentId, relation, ...body } = input;
-			return await getPluginService('client')
-				.reportAbuse(commentId, relation, body);
+			try {
+				return await getPluginService('client')
+					.reportAbuse(commentId, relation, body, user);
+			} catch(e) {
+				throw new Error(e);
+			}
 		},
 	};
 }

package/server/graphql/mutations/createComment.js

@@ -10,11 +10,16 @@ module.exports = ({ nexus }) => {
 		args: {
 			input: nonNull('CreateComment'),
 		},
-		async resolve(obj, args) {
+		async resolve(obj, args, ctx) {
 			const { input } = args;
+			const { state: { user } = {} } = ctx;
 			const { relation, ...body } = input;
-			return await getPluginService('client')
-				.create(relation, body);
+			try {
+				return await getPluginService('client')
+					.create(relation, body, user);
+			} catch(e) {
+				throw new Error(e);
+			}
 		},
 	};
 }

package/server/graphql/mutations/removeComment.js

@@ -10,11 +10,16 @@ module.exports = ({ nexus }) => {
 		args: {
 			input: nonNull('RemoveComment'),
 		},
-		async resolve(obj, args) {
+		async resolve(obj, args, ctx) {
 			const { input } = args;
+			const { state: { user } = {} } = ctx;
 			const { id, relation, author } = input;
-			return await getPluginService('client')
-				.markAsRemoved(id, relation, author?.id);
+			try {
+				return await getPluginService('client')
+					.markAsRemoved(id, relation, author?.id, user);
+			} catch(e) {
+				throw new Error(e);
+			}
 		},
 	};
 }

package/server/graphql/mutations/updateComment.js

@@ -10,11 +10,16 @@ module.exports = ({ nexus }) => {
 		args: {
 			input: nonNull('UpdateComment'),
 		},
-		async resolve(obj, args) {
+		async resolve(obj, args, ctx) {
 			const { input } = args;
+			const { state: { user } = {} } = ctx;
 			const { id, relation, ...body } = input;
-			return await getPluginService('client')
-				.update(id, relation, body);
+			try {
+				return await getPluginService('client')
+					.update(id, relation, body, user);
+			} catch(e) {
+				throw new Error(e);
+			}
 		},
 	};
 }

package/server/graphql/resolvers-config.js

@@ -1,10 +1,15 @@
 'use strict'
 
-module.exports = ({ }) => ({
-	'Query.findAllFlat': { auth: false },
-	'Query.findAllInHierarchy': { auth: false },
-	'Mutation.createComment': { auth: false },
-	'Mutation.updateComment': { auth: false },
-	'Mutation.removeComment': { auth: false },
-	'Mutation.createAbuseReport': { auth: false },
-});
+const { getPluginService } = require("../utils/functions");
+
+module.exports = () => {
+	const auth = getPluginService('common').getConfig('gql.auth', false);
+	return {
+		'Query.findAllFlat': { auth },
+		'Query.findAllInHierarchy': { auth },
+		'Mutation.createComment': { auth },
+		'Mutation.updateComment': { auth },
+		'Mutation.removeComment': { auth },
+		'Mutation.createAbuseReport': { auth },
+	};
+};

package/server/graphql/types/comment-nested.js

@@ -8,7 +8,6 @@ module.exports = ({ nexus }) => nexus.objectType({
     t.string("approvalStatus")
     t.field("threadOf", { type: 'CommentSingle' })
     t.list.field("children", { type: 'CommentNested' })
-    t.field("authorUser", { type: 'CommentAuthorUser' })
     t.field("author", { type: 'CommentAuthor' })
     t.string("createdAt")
     t.string("updatedAt")

package/server/graphql/types/comment.js

@@ -8,7 +8,6 @@ module.exports = ({ nexus }) => nexus.objectType({
     t.boolean("removed")
     t.string("approvalStatus")
     t.field("threadOf", { type: 'CommentSingle' })
-    t.field("authorUser", { type: 'CommentAuthorUser' })
     t.field("author", { type: 'CommentAuthor' })
     t.string("createdAt")
     t.string("updatedAt")

package/server/graphql/types/create-comment-author.js

@@ -1,7 +1,7 @@
 module.exports = ({ nexus }) => nexus.inputObjectType({
   name: "CreateCommentAuthor",
   definition(t) {
-    t.nonNull.string("id")
+    t.nonNull.id("id")
     t.nonNull.string("name")
     t.string("email")
     t.string("avatar")

package/server/graphql/types/identify-comment-author.js

@@ -1,6 +1,6 @@
 module.exports = ({ nexus }) => nexus.inputObjectType({
   name: "IdentifyCommentAuthor",
   definition(t) {
-    t.nonNull.string("id")
+    t.nonNull.id("id")
   }
 })

package/server/graphql/types/index.js

@@ -3,7 +3,6 @@ const typesFactories = [
 	require('./comment'),
 	require('./comment-nested'),
 	require('./comment-author'),
-	require('./comment-author-user'),
 	require('./create-comment'),
 	require('./create-comment-author'),
 	require('./update-comment'),

package/server/services/admin.js

@@ -117,19 +117,24 @@ const { APPROVAL_STATUS, REGEX } = require('./../utils/constants')
             }
         };
 
-        const entity = await strapi.db.query(getModelUid('comment')).findOne({ 
-            where: {
-                id,
-            },
+        const defaultPopulate = {
             populate: {
                 authorUser: true,
                 threadOf: {
                     populate: { 
+                        authorUser: true,
                         ...reportsPopulation
                     },
                 },
                 ...reportsPopulation,
             },
+        }
+
+        const entity = await strapi.db.query(getModelUid('comment')).findOne({ 
+            where: {
+                id,
+            },
+            ...defaultPopulate,
         });
 
         if (!entity){
@@ -159,9 +164,7 @@ const { APPROVAL_STATUS, REGEX } = require('./../utils/constants')
                     threadOf: levelThreadId,
                     related: entity.related,
                 },
-                populate: {
-                    ...reportsPopulation,
-                },
+                ...defaultPopulate,
                 startingFromId: levelThreadId,
                 isAdmin: true
             }, false);

package/server/services/client.js

@@ -9,7 +9,6 @@ const {
     getModelUid,
     getRelatedGroups,
     checkBadWords,
-    isValidUserContext,
     resolveUserContextError,
 } = require('./utils/functions');
 const { APPROVAL_STATUS, REGEX } = require('./../utils/constants')
@@ -49,7 +48,7 @@ module.exports = ({ strapi }) => ({
             id: threadOf,
             related: relation,
         }) : true;
-        const validContext = isValidUserContext(user);
+        const validContext = this.getCommonService().isValidUserContext(user);
 
         if (!linkToThread) {
             throw new PluginError(400, 'Thread does not exist');
@@ -60,15 +59,11 @@ module.exports = ({ strapi }) => ({
         }
 
         if (checkBadWords(content) && singleRelationFulfilled) {
-            const { author, authorUser, ...rest } = data;
+            const { author = {}, ...rest } = data;
             let authorData = {};
             if (validContext && user) {
                 authorData = {
-                    authorUser: user?.id || authorUser,
-                };
-            } else if (authorUser) {
-                authorData = {
-                    authorUser,
+                    authorUser: user?.id,
                 };
             } else {
                 if (author.email && !REGEX.email.test(author.email)) {
@@ -83,8 +78,8 @@ module.exports = ({ strapi }) => ({
                 };
             }
             
-            if (!isEmpty(authorData) && !authorData.authorId) {
-                throw new PluginError(400, 'Object: "author" is invalid. Check your payload');
+            if (!isEmpty(authorData) && !(authorData.authorId || authorData.authorUser)) {
+                throw new PluginError(400, `Not able to recognise author of a comment. Make sure you've provided "author" property in a payload or authenticated your request properly.`);
             }
 
             if (isApprovalFlowEnabled && 
@@ -98,7 +93,10 @@ module.exports = ({ strapi }) => ({
                     ...authorData,
                     related: relation,
                     approvalStatus: isApprovalFlowEnabled ? APPROVAL_STATUS.PENDING : null,
-                }
+                },
+                populate: {
+                    authorUser: true,
+                },
             });
             return this.getCommonService().sanitizeCommentEntity({
                 ...entity,
@@ -109,20 +107,21 @@ module.exports = ({ strapi }) => ({
     },
 
     // Update a comment
-    async update(id, relation, data, user) {
+    async update(id, relation, data, user = undefined) {
         const { content } = data;
 
         const singleRelationFulfilled = relation && REGEX.relatedUid.test(relation)
 
         if(!singleRelationFulfilled) {
-            throw new PluginError(400, `Field "related" got incorrect format, use format like "api::<collection name>.<content type name>:<entity id>"`);
+            throw new PluginError(400, `Request property "relation" got incorrect format, use format like "api::<collection name>.<content type name>:<entity id>"`);
         }
 
         const existingEntity = await this.getCommonService().findOne({
             id,
             related: relation,
         });
-        const validContext = isValidUserContext(user);
+
+        const validContext = this.getCommonService().isValidUserContext(user);
 
         if (!validContext) {
             throw resolveUserContextError(user);
@@ -133,17 +132,17 @@ module.exports = ({ strapi }) => ({
                 const entity = await strapi.db.query(getModelUid('comment')).update({
                     where: { id },
                     data: { content },
-                    populate: { threadOf: true },
+                    populate: { threadOf: true, authorUser: true },
                 });
                 return this.getCommonService().sanitizeCommentEntity(entity);
             }
         }
-        throw new PluginError(409, 'Action on that entity is not allowed');
+        throw new PluginError(403, `You're not allowed to take an action on that entity. Make sure you've provided "author" property in a payload or authenticated your request properly.`);
     },
 
     // Report abuse in comment
-	async reportAbuse(id, relation, payload, user) {
-        if (!isValidUserContext(user)) {
+	async reportAbuse(id, relation, payload, user = undefined) {
+        if (!this.getCommonService().isValidUserContext(user)) {
             throw resolveUserContextError(user);
         }
 		const reportAgainstEntity = await this.getCommonService().findOne({
@@ -173,18 +172,34 @@ module.exports = ({ strapi }) => ({
                 throw new PluginError(500, 'Report cannot be created');
             }
         }
-        throw new PluginError(409, 'Action on that entity is not allowed');
+        throw new PluginError(403, `You're not allowed to take an action on that entity. Make sure that comment exist or you've authenticated your request properly.`);
     },
 
-    async markAsRemoved(id, relation, authorId){
-        const entity = await this.getCommonService().findOne({
-            id,
-            related: relation,
-            $or: [{ authorUser: authorId }, { authorId }],
-        });
+    async markAsRemoved(id, relation, authorId, user = undefined){
+        if (!this.getCommonService().isValidUserContext(user)) {
+            throw resolveUserContextError(user);
+        }
+
+        const author = user?.id || authorId;
 
-        if (!entity) {
-            throw new PluginError(404, 'Entity not exist');
+        if (!author) {
+            throw new PluginError(403, `You're not allowed to take an action on that entity. Make sure that you've provided proper "authorId" or authenticated your request properly.`);
+        }
+
+        let entity;
+        try {
+            const byAuthor = user?.id ? {
+                authorUser: author
+            } : {
+                authorId: author
+            }
+            entity = await this.getCommonService().findOne({
+                id,
+                related: relation,
+                ...byAuthor,
+            });
+        } catch(e) {
+            throw new PluginError(404, `Entity does not exist or you're not allowed to take an action on it`);
         }
 
         const removedEntity = await strapi.db.query(getModelUid('comment'))
@@ -194,7 +209,7 @@ module.exports = ({ strapi }) => ({
                   related: relation
                 },
                 data: { removed: true },
-                populate: { threadOf: true },
+                populate: { threadOf: true, authorUser: true },
           })
         await this.markAsRemovedNested(id, true);
 

package/server/services/common.js

@@ -1,6 +1,6 @@
 'use strict';
 
-const { isArray, isNumber, isObject, first, parseInt } = require('lodash');
+const { isArray, isNumber, isObject, isNil, first, parseInt } = require('lodash');
 // const { sanitizeEntity } = require('strapi-utils');
 const PluginError = require('./../utils/error');
 const {
@@ -86,8 +86,12 @@ module.exports = ({ strapi }) => ({
     async findOne(criteria) {
         const entity = await strapi.db.query(getModelUid('comment'))
             .findOne({
-                where: criteria
-            }, ['related', 'reports']);
+                where: criteria,
+                populate: {
+                    reports: true,
+                    authorUser: true,
+                },
+            });
         if (!entity){
             throw new PluginError(404, 'Not found');
         }
@@ -154,15 +158,16 @@ module.exports = ({ strapi }) => ({
         }
     },
 
-    sanitizeCommentEntity: (entity) => ({
-        ...buildAuthorModel({
-            ...entity,
-            threadOf: isObject(entity.threadOf) ? buildAuthorModel(entity.threadOf) : entity.threadOf,
-        }),
-	}),
-
-    // sanitizeCommentEntity: (entity) => ({
-    //     ...entity,
-    //     authorUser: sanitizeEntity(entity.authorUser, { model: strapi.plugins['users-permissions'].models.user }),
-	// }),
+    sanitizeCommentEntity(entity) {
+        return {
+            ...buildAuthorModel({
+                ...entity,
+                threadOf: isObject(entity.threadOf) ? buildAuthorModel(entity.threadOf) : entity.threadOf,
+            }),
+        };
+    },
+
+    isValidUserContext(user) {
+        return user ? !isNil(user?.id) : true;
+    },
 });

package/server/services/utils/functions.js

@@ -1,7 +1,7 @@
 const BadWordsFilter = require('bad-words');
 const PluginError = require('./../../utils/error');
 const { REGEX } = require('./../../utils/constants')
-const { first, get, isObject, isNil } = require('lodash');
+const { first, get, isObject, isEmpty } = require('lodash');
 
 const buildNestedStructure = (
   entities,
@@ -33,7 +33,7 @@ const buildNestedStructure = (
 
 module.exports = {
     isEqualEntity: (existing, data, user) => {
-        const { authorUser, author: existingAuthor } = existing;
+        const { author: existingAuthor } = existing;
         const { author } = data;
 
         // Disallow approval status change by Client
@@ -42,10 +42,10 @@ module.exports = {
         }
 
         // Make sure that author is exact the same
-        if (authorUser) {
-            const existingUserId = authorUser?.id || authorUser;
-            const receivedUserId = user?.id || author;
-            return existingUserId === receivedUserId;
+        if (user) {
+            const existingUserId = existingAuthor?.id || existingAuthor;
+            const receivedUserId = user?.id || author?.id;
+            return receivedUserId && (existingUserId === receivedUserId);
         }
         return existingAuthor.id === author?.id;
     },
@@ -85,22 +85,27 @@ module.exports = {
 
     buildNestedStructure,
 
-    isValidUserContext: (user = {}) => {
-		const builtInContextEnabled = get(strapi.config, 'plugins.comments.enableUsers', false);
-        return builtInContextEnabled ? !isNil(user.id) : true;
-    },
-
     buildAuthorModel: (item) => {
         const { authorUser, authorId, authorName, authorEmail, authorAvatar, ...rest } = item;
-        const author = authorUser || {
-            id: authorId,
-            name: authorName,
-            email: authorEmail,
-            avatar: authorAvatar,
-        };
+        let author = {};
+        if (authorUser) {
+            author = {
+                id: authorUser.id,
+                name: authorUser.username,
+                email: authorUser.email,
+                avatar: authorUser.avatar,
+            };
+        } else if(authorId) {
+            author = {
+                id: authorId,
+                name: authorName,
+                email: authorEmail,
+                avatar: authorAvatar,
+            };
+        }
         return {
             ...rest,
-            author,
+            author: isEmpty(author) ? undefined : author,
         };
     },
 

package/server/graphql/types/comment-author-user.js

@@ -1,9 +0,0 @@
-module.exports = ({ nexus }) => nexus.objectType({
-  name: "CommentAuthorUser",
-  definition(t) {
-    t.id("id")
-    t.nonNull.string("firstName")
-    t.string("lastName")
-    t.string("email")
-  }
-})