updates and fixes

* seo friendly urls
* custom client serve-static module
* database fixes
* fix recent pages
* other fixes

apps/server/src/core/comment/comment.service.ts

@@ -1,12 +1,13 @@
 import {
   BadRequestException,
+  ForbiddenException,
   Injectable,
   NotFoundException,
 } from '@nestjs/common';
 import { CreateCommentDto } from './dto/create-comment.dto';
 import { UpdateCommentDto } from './dto/update-comment.dto';
 import { CommentRepo } from '@docmost/db/repos/comment/comment.repo';
-import { Comment } from '@docmost/db/types/entity.types';
+import { Comment, User } from '@docmost/db/types/entity.types';
 import { PaginationOptions } from '@docmost/db/pagination/pagination-options';
 import { PaginationResult } from '@docmost/db/pagination/pagination';
 import { PageRepo } from '@docmost/db/repos/page/page.repo';
@@ -30,24 +31,18 @@ export class CommentService {
 
   async create(
     userId: string,
+    pageId: string,
     workspaceId: string,
     createCommentDto: CreateCommentDto,
   ) {
     const commentContent = JSON.parse(createCommentDto.content);
 
-    const page = await this.pageRepo.findById(createCommentDto.pageId);
-    // const spaceId = null; // todo, get from page
-
-    if (!page) {
-      throw new BadRequestException('Page not found');
-    }
-
     if (createCommentDto.parentCommentId) {
       const parentComment = await this.commentRepo.findById(
         createCommentDto.parentCommentId,
       );
 
-      if (!parentComment) {
+      if (!parentComment || parentComment.pageId !== pageId) {
         throw new BadRequestException('Parent comment not found');
       }
 
@@ -57,10 +52,10 @@ export class CommentService {
     }
 
     const createdComment = await this.commentRepo.insertComment({
-      pageId: createCommentDto.pageId,
+      pageId: pageId,
       content: commentContent,
       selection: createCommentDto?.selection?.substring(0, 250),
-      type: 'inline', // for now
+      type: 'inline',
       parentCommentId: createCommentDto?.parentCommentId,
       creatorId: userId,
       workspaceId: workspaceId,
@@ -90,6 +85,7 @@ export class CommentService {
   async update(
     commentId: string,
     updateCommentDto: UpdateCommentDto,
+    authUser: User,
   ): Promise<Comment> {
     const commentContent = JSON.parse(updateCommentDto.content);
 
@@ -98,6 +94,10 @@ export class CommentService {
       throw new NotFoundException('Comment not found');
     }
 
+    if (comment.creatorId !== authUser.id) {
+      throw new ForbiddenException('You can only edit your own comments');
+    }
+
     const editedAt = new Date();
 
     await this.commentRepo.updateComment(
@@ -113,12 +113,17 @@ export class CommentService {
     return comment;
   }
 
-  async remove(commentId: string): Promise<void> {
+  async remove(commentId: string, authUser: User): Promise<void> {
     const comment = await this.commentRepo.findById(commentId);
 
     if (!comment) {
       throw new NotFoundException('Comment not found');
     }
+
+    if (comment.creatorId !== authUser.id) {
+      throw new ForbiddenException('You can only delete your own comments');
+    }
+
     await this.commentRepo.deleteComment(commentId);
   }
 }