Better authorize comment actions

app/Livewire/Item/Comment.php

@@ -65,7 +65,8 @@ public function editAction(): Action
             ->modalWidth(Width::TwoExtraLarge)
             ->modalSubmitActionLabel(trans('general.save'))
             ->fillForm(function (array $arguments): array {
-                $comment = CommentModel::findOrFail($arguments['comment']);
+                $comment = $this->findOwnComment($arguments['comment'] ?? null);
+
                 return [
                     'content' => $comment->content,
                 ];
@@ -74,11 +75,12 @@ public function editAction(): Action
                 MarkdownEditor::make('content')
                     ->hiddenLabel()
                     ->mentions($this->item)
+                    ->rules([new ProfanityCheck()])
                     ->required()
             ])
             ->link()
             ->action(function (array $data, array $arguments): void {
-                $comment = auth()->user()->comments()->findOrFail($arguments['comment']);
+                $comment = $this->findOwnComment($arguments['comment'] ?? null);
                 $comment->update(['content' => $data['content']]);
 
                 $this->redirectRoute('items.show', $comment->item->slug);
@@ -162,4 +164,16 @@ protected function getFormSchema(): array
                 ->rules([new ProfanityCheck()]),
         ];
     }
+
+    /**
+     * Find a comment owned by the current user.
+     *
+     * Action arguments are supplied by the client, so they can never be trusted to reference an owned comment.
+     */
+    protected function findOwnComment(mixed $commentId): CommentModel
+    {
+        return CommentModel::query()
+            ->where('user_id', auth()->id())
+            ->findOrFail((int) $commentId);
+    }
 }

tests/Feature/Livewire/Item/CommentTest.php

@@ -6,10 +6,18 @@
 use Livewire\Livewire;
 use App\Models\Comment;
 use App\Models\Project;
+use App\Settings\GeneralSettings;
 use Illuminate\Support\Facades\DB;
 use Filament\Actions\Testing\TestAction;
 use App\Livewire\Item\Comment as CommentComponent;
 
+beforeEach(function () {
+    GeneralSettings::fake([
+        'users_must_verify_email' => false,
+        'profanity_words' => ['badword'],
+    ]);
+});
+
 function mountComment(Comment $comment): \Livewire\Features\SupportTesting\Testable
 {
     return Livewire::test(CommentComponent::class, [
@@ -133,3 +141,72 @@ function mountComment(Comment $comment): \Livewire\Features\SupportTesting\Testa
 
     expect($commentQueries)->toHaveCount(1);
 });
+
+test('an unverified user is redirected to verify their email when replying', function () {
+    app(GeneralSettings::class)->users_must_verify_email = true;
+    createAndLoginUser(user: User::factory()->unverified()->create());
+
+    $comment = Comment::factory()->for(Item::factory())->for(User::factory())->create();
+
+    mountComment($comment)
+        ->set('replyContent', 'An unverified reply')
+        ->call('submitReply')
+        ->assertRedirect(route('verification.notice'));
+
+    expect(Comment::query()->where('parent_id', $comment->id)->exists())->toBeFalse();
+});
+
+test('a reply containing profanity is rejected', function () {
+    createAndLoginUser();
+
+    $comment = Comment::factory()->for(Item::factory())->for(User::factory())->create();
+
+    mountComment($comment)
+        ->set('replyContent', 'A badword reply')
+        ->call('submitReply')
+        ->assertHasErrors(['replyContent']);
+
+    expect(Comment::query()->where('parent_id', $comment->id)->exists())->toBeFalse();
+});
+
+test('a user can edit their own comment', function () {
+    $user = createAndLoginUser();
+
+    $comment = Comment::factory()->for(Item::factory())->for($user)->create(['content' => 'Original content']);
+
+    mountComment($comment)
+        ->mountAction(TestAction::make('edit')->arguments(['comment' => $comment->id]))
+        ->assertSchemaStateSet(['content' => 'Original content'])
+        ->fillForm(['content' => 'Updated content'])
+        ->callMountedAction()
+        ->assertHasNoFormErrors();
+
+    expect($comment->fresh()->content)->toBe('Updated content');
+});
+
+test('an edit containing profanity is rejected', function () {
+    $user = createAndLoginUser();
+
+    $comment = Comment::factory()->for(Item::factory())->for($user)->create(['content' => 'Original content']);
+
+    mountComment($comment)
+        ->callAction(TestAction::make('edit')->arguments(['comment' => $comment->id]), data: ['content' => 'A badword edit'])
+        ->assertHasFormErrors(['content']);
+
+    expect($comment->fresh()->content)->toBe('Original content');
+});
+
+test('the edit form does not expose the content of another user\'s comment', function () {
+    $user = createAndLoginUser();
+
+    $item = Item::factory()->create();
+    $ownComment = Comment::factory()->for($item)->for($user)->create();
+    $privateNote = Comment::factory()->for($item)->for(User::factory()->admin())->create([
+        'content' => 'Secret internal note',
+        'private' => true,
+    ]);
+
+    expect(fn () => mountComment($ownComment)
+        ->mountAction(TestAction::make('edit')->arguments(['comment' => $privateNote->id])))
+        ->toThrow(Illuminate\Database\Eloquent\ModelNotFoundException::class);
+});