diff --git a/src/main/kotlin/fr/dcproject/security/voter/CommentVoter.kt b/src/main/kotlin/fr/dcproject/security/voter/CommentVoter.kt index dd129ea..af82b5d 100644 --- a/src/main/kotlin/fr/dcproject/security/voter/CommentVoter.kt +++ b/src/main/kotlin/fr/dcproject/security/voter/CommentVoter.kt @@ -18,19 +18,27 @@ class CommentVoter : Voter { override fun vote(action: ActionI, call: ApplicationCall, subject: Any?): Vote { val user = call.user - if (action == Action.CREATE && user != null) { + + if (subject !is Comment<*> ) { + return Vote.DENIED + } + + if (action == Action.CREATE) { + if (user == null) { + return Vote.DENIED + } + if (subject.createdBy.user.id != user.id) { + return Vote.DENIED + } return Vote.GRANTED } if (action == Action.VIEW) { - if (subject is Comment<*>) { - return if (subject.isDeleted()) Vote.DENIED - else Vote.GRANTED - } - return Vote.DENIED + return if (subject.isDeleted()) Vote.DENIED + else Vote.GRANTED } - if (action == Action.UPDATE && user != null && subject is Comment<*> && user.id == subject.createdBy.user.id) { + if (action == Action.UPDATE && user != null && user.id == subject.createdBy.user.id) { return Vote.GRANTED } diff --git a/src/test/kotlin/fr/dcproject/security/voter/CommentVoterTest.kt b/src/test/kotlin/fr/dcproject/security/voter/CommentVoterTest.kt index 9ce677e..bb90a3b 100644 --- a/src/test/kotlin/fr/dcproject/security/voter/CommentVoterTest.kt +++ b/src/test/kotlin/fr/dcproject/security/voter/CommentVoterTest.kt @@ -108,4 +108,40 @@ internal class CommentVoterTest { can(CommentVoter.Action.DELETE, it, comment1) `should be` false } } + + @Test + fun `can be create a comment`() = listOf(CommentVoter()).run { + mockk { + every { user } returns tesla.user + }.let { + can(CommentVoter.Action.CREATE, it, comment1) `should be` true + } + } + + @Test + fun `can not be create a comment with other creator`() = listOf(CommentVoter()).run { + mockk { + every { user } returns einstein.user + }.let { + can(CommentVoter.Action.CREATE, it, comment1) `should be` false + } + } + + @Test + fun `can not be create a comment if is null`() = listOf(CommentVoter()).run { + mockk { + every { user } returns einstein.user + }.let { + can(CommentVoter.Action.CREATE, it, null) `should be` false + } + } + + @Test + fun `can not be create a comment if not connected`() = listOf(CommentVoter()).run { + mockk { + every { user } returns null + }.let { + can(CommentVoter.Action.CREATE, it, comment1) `should be` false + } + } } \ No newline at end of file