fixes

* fix comments
* fix page history
* fix aside width on smaller screens

apps/server/src/core/comment/comment.controller.ts

@@ -5,6 +5,8 @@ import {
   HttpCode,
   HttpStatus,
   UseGuards,
+  NotFoundException,
+  ForbiddenException,
 } from '@nestjs/common';
 import { CommentService } from './comment.service';
 import { CreateCommentDto } from './dto/create-comment.dto';
@@ -15,43 +17,90 @@ import { AuthWorkspace } from '../../decorators/auth-workspace.decorator';
 import { JwtAuthGuard } from '../../guards/jwt-auth.guard';
 import { PaginationOptions } from '@docmost/db/pagination/pagination-options';
 import { User, Workspace } from '@docmost/db/types/entity.types';
+import SpaceAbilityFactory from '../casl/abilities/space-ability.factory';
+import { PageRepo } from '@docmost/db/repos/page/page.repo';
+import {
+  SpaceCaslAction,
+  SpaceCaslSubject,
+} from '../casl/interfaces/space-ability.type';
+import { CommentRepo } from '@docmost/db/repos/comment/comment.repo';
 
 @UseGuards(JwtAuthGuard)
 @Controller('comments')
 export class CommentController {
-  constructor(private readonly commentService: CommentService) {}
+  constructor(
+    private readonly commentService: CommentService,
+    private readonly commentRepo: CommentRepo,
+    private readonly pageRepo: PageRepo,
+    private readonly spaceAbility: SpaceAbilityFactory,
+  ) {}
 
-  @HttpCode(HttpStatus.CREATED)
+  @HttpCode(HttpStatus.OK)
   @Post('create')
   async create(
     @Body() createCommentDto: CreateCommentDto,
     @AuthUser() user: User,
     @AuthWorkspace() workspace: Workspace,
   ) {
+    const page = await this.pageRepo.findById(createCommentDto.pageId);
+    if (!page) {
+      throw new NotFoundException('Page not found');
+    }
+
+    const ability = await this.spaceAbility.createForUser(user, page.spaceId);
+    if (ability.cannot(SpaceCaslAction.Create, SpaceCaslSubject.Page)) {
+      throw new ForbiddenException();
+    }
+
     return this.commentService.create(user.id, workspace.id, createCommentDto);
   }
 
   @HttpCode(HttpStatus.OK)
-  @Post()
-  findPageComments(
+  @Post('/')
+  async findPageComments(
     @Body() input: PageIdDto,
     @Body()
     pagination: PaginationOptions,
-    //@AuthUser() user: User,
+    @AuthUser() user: User,
     //  @AuthWorkspace() workspace: Workspace,
   ) {
+    const page = await this.pageRepo.findById(input.pageId);
+    if (!page) {
+      throw new NotFoundException('Page not found');
+    }
+
+    const ability = await this.spaceAbility.createForUser(user, page.spaceId);
+    if (ability.cannot(SpaceCaslAction.Read, SpaceCaslSubject.Page)) {
+      throw new ForbiddenException();
+    }
     return this.commentService.findByPageId(input.pageId, pagination);
   }
 
   @HttpCode(HttpStatus.OK)
   @Post('info')
-  findOne(@Body() input: CommentIdDto) {
-    return this.commentService.findById(input.commentId);
+  async findOne(@Body() input: CommentIdDto, @AuthUser() user: User) {
+    const comment = await this.commentRepo.findById(input.commentId);
+    if (!comment) {
+      throw new NotFoundException('Comment not found');
+    }
+
+    // TODO: add spaceId to comment entity.
+    const page = await this.pageRepo.findById(comment.pageId);
+    if (!page) {
+      throw new NotFoundException('Page not found');
+    }
+
+    const ability = await this.spaceAbility.createForUser(user, page.spaceId);
+    if (ability.cannot(SpaceCaslAction.Read, SpaceCaslSubject.Page)) {
+      throw new ForbiddenException();
+    }
+    return comment;
   }
 
   @HttpCode(HttpStatus.OK)
   @Post('update')
-  update(@Body() updateCommentDto: UpdateCommentDto) {
+  update(@Body() updateCommentDto: UpdateCommentDto, @AuthUser() user: User) {
+    //TODO: only comment creators can update their comments
     return this.commentService.update(
       updateCommentDto.commentId,
       updateCommentDto,
@@ -60,7 +109,8 @@ export class CommentController {
 
   @HttpCode(HttpStatus.OK)
   @Post('delete')
-  remove(@Body() input: CommentIdDto) {
+  remove(@Body() input: CommentIdDto, @AuthUser() user: User) {
+    // TODO: only comment creators and admins can delete their comments
     return this.commentService.remove(input.commentId);
   }
 }

apps/server/src/core/comment/comment.module.ts

@@ -1,10 +1,9 @@
 import { Module } from '@nestjs/common';
 import { CommentService } from './comment.service';
 import { CommentController } from './comment.controller';
-import { PageModule } from '../page/page.module';
 
 @Module({
-  imports: [PageModule],
+  imports: [],
   controllers: [CommentController],
   providers: [CommentService],
   exports: [CommentService],

apps/server/src/core/comment/comment.service.ts

@@ -5,17 +5,17 @@ import {
 } from '@nestjs/common';
 import { CreateCommentDto } from './dto/create-comment.dto';
 import { UpdateCommentDto } from './dto/update-comment.dto';
-import { PageService } from '../page/services/page.service';
 import { CommentRepo } from '@docmost/db/repos/comment/comment.repo';
 import { Comment } from '@docmost/db/types/entity.types';
 import { PaginationOptions } from '@docmost/db/pagination/pagination-options';
 import { PaginationResult } from '@docmost/db/pagination/pagination';
+import { PageRepo } from '@docmost/db/repos/page/page.repo';
 
 @Injectable()
 export class CommentService {
   constructor(
     private commentRepo: CommentRepo,
-    private pageService: PageService,
+    private pageRepo: PageRepo,
   ) {}
 
   async findById(commentId: string) {
@@ -35,7 +35,7 @@ export class CommentService {
   ) {
     const commentContent = JSON.parse(createCommentDto.content);
 
-    const page = await this.pageService.findById(createCommentDto.pageId);
+    const page = await this.pageRepo.findById(createCommentDto.pageId);
     // const spaceId = null; // todo, get from page
 
     if (!page) {
@@ -59,7 +59,7 @@ export class CommentService {
     const createdComment = await this.commentRepo.insertComment({
       pageId: createCommentDto.pageId,
       content: commentContent,
-      selection: createCommentDto?.selection.substring(0, 250),
+      selection: createCommentDto?.selection?.substring(0, 250),
       type: 'inline', // for now
       parentCommentId: createCommentDto?.parentCommentId,
       creatorId: userId,
@@ -74,7 +74,7 @@ export class CommentService {
     pageId: string,
     pagination: PaginationOptions,
   ): Promise<PaginationResult<Comment>> {
-    const page = await this.pageService.findById(pageId);
+    const page = await this.pageRepo.findById(pageId);
 
     if (!page) {
       throw new BadRequestException('Page not found');

apps/server/src/kysely/repos/page/page-history.repo.ts

@@ -18,24 +18,11 @@ import { DB } from '@docmost/db/types/db';
 export class PageHistoryRepo {
   constructor(@InjectKysely() private readonly db: KyselyDB) {}
 
-  private baseFields: Array<keyof PageHistory> = [
-    'id',
-    'pageId',
-    'title',
-    'slug',
-    'icon',
-    'coverPhoto',
-    'version',
-    'lastUpdatedById',
-    'workspaceId',
-    'createdAt',
-    'updatedAt',
-  ];
-
   async findById(pageHistoryId: string): Promise<PageHistory> {
     return await this.db
       .selectFrom('pageHistory')
-      .select((eb) => [...this.baseFields, this.withLastUpdatedBy(eb)])
+      .selectAll()
+      .select((eb) => this.withLastUpdatedBy(eb))
       .where('id', '=', pageHistoryId)
       .executeTakeFirst();
   }
@@ -83,7 +70,8 @@ export class PageHistoryRepo {
   async findPageHistoryByPageId(pageId: string, pagination: PaginationOptions) {
     const query = this.db
       .selectFrom('pageHistory')
-      .select((eb) => [...this.baseFields, this.withLastUpdatedBy(eb)])
+      .selectAll()
+      .select((eb) => this.withLastUpdatedBy(eb))
       .where('pageId', '=', pageId)
       .orderBy('createdAt', 'desc');
 
@@ -101,6 +89,6 @@ export class PageHistoryRepo {
         .selectFrom('users')
         .select(['users.id', 'users.name', 'users.avatarUrl'])
         .whereRef('users.id', '=', 'pageHistory.lastUpdatedById'),
-    ).as('withLastUpdatedBy');
+    ).as('lastUpdatedBy');
   }
 }