|
# retoor <retoor@molodetz.nl>
|
|
|
|
import logging
|
|
from typing import Annotated
|
|
from fastapi import APIRouter, Request, Form
|
|
from fastapi.responses import RedirectResponse
|
|
from devplacepy.database import get_table, resolve_object_url
|
|
from devplacepy.content import is_owner, create_comment_record, delete_comment_record
|
|
from devplacepy.utils import require_user, is_admin
|
|
from devplacepy.models import CommentForm
|
|
from devplacepy.responses import action_result, wants_json, json_error
|
|
from devplacepy.services.audit import record as audit
|
|
|
|
logger = logging.getLogger(__name__)
|
|
router = APIRouter()
|
|
|
|
|
|
@router.post("/create")
|
|
async def create_comment(request: Request, data: Annotated[CommentForm, Form()]):
|
|
user = require_user(request)
|
|
target_uid = data.target_uid or data.post_uid
|
|
comment_uid, comment_url = create_comment_record(
|
|
request,
|
|
user,
|
|
data.target_type,
|
|
target_uid,
|
|
data.content.strip(),
|
|
data.parent_uid,
|
|
data.attachment_uids,
|
|
)
|
|
return action_result(
|
|
request, comment_url, data={"uid": comment_uid, "url": comment_url}
|
|
)
|
|
|
|
|
|
@router.post("/delete/{comment_uid}")
|
|
async def delete_comment(request: Request, comment_uid: str):
|
|
user = require_user(request)
|
|
comments = get_table("comments")
|
|
comment = comments.find_one(uid=comment_uid, deleted_at=None)
|
|
if not comment or not (is_owner(comment, user) or is_admin(user)):
|
|
audit.record(
|
|
request,
|
|
"comment.delete",
|
|
user=user,
|
|
result="denied",
|
|
target_type="comment",
|
|
target_uid=comment_uid,
|
|
summary=f"{user['username']} denied deleting comment {comment_uid}",
|
|
)
|
|
if wants_json(request):
|
|
return json_error(403, "Not allowed")
|
|
return RedirectResponse(url="/feed", status_code=302)
|
|
target_type, target_uid = delete_comment_record(request, user, comment)
|
|
redirect_url = resolve_object_url(target_type, target_uid)
|
|
return action_result(request, redirect_url)
|