feat: add support for comments in forms#3329
Conversation
Chartman123
added
enhancement
Chartman123
added
integration
Chartman123
force-pushed
the
enh/comments
branch
7 times, most recently
from
12754de to
abafef8
Compare
Codecov Report❌ Patch coverage is 📢 Thoughts on this report? Let us know! |
Chartman123
force-pushed
the
enh/comments
branch
2 times, most recently
from
b1cd4d0 to
d93d465
Compare
Signed-off-by: Christian Hartmann <chris-hartmann@gmx.de>
|
Front-end code was created with assistance by Copilot. There's probably room for improvement. I'm also facing the problem that sometimes the comments tab loads, but doesn't show existing comments. Probably some kind of race condition. |
|
|
||
| // Register the 'forms' entity collection so the Comments app can | ||
| // check whether a given form id allows comments. | ||
| $event->addEntityCollection('forms', function ($formId) { |
There was a problem hiding this comment.
As far as I can tell this callback is the only thing the comments layer checks before letting someone read or write. Checking just allowComments means any logged-in user can hit /comments/forms/<id> and post or read comments on any form with comments enabled, no share access required. Maybe we need the some kind of per-user check here?
There was a problem hiding this comment.
yes this makes sense, we should check here if the current user:
- is the owner
- or the form is shared with the user
There was a problem hiding this comment.
We shouldn't limit comments to the owner or shared admins but to all logged in users with access to the form. The use case of the feature request was for allowing communication between respondents.
There was a problem hiding this comment.
yes that what I meant we still would need the check:
- is the form shared with anyone?
- otherwise: is the user the owner
- otherwise: is the form shared with the user
Because otherwise some user could read comments of a form where he does not have access to
There was a problem hiding this comment.
Yes that's right. I first thought that you meant only shared edit permissions
|
Should we also clean up comments when a form is deleted? ( |
3 participants
This closes #1655 by integrating the comments app.
Signed-off-by: Christian Hartmann chris-hartmann@gmx.de