#42 Improve CommentVoter

src/main/kotlin/fr/dcproject/security/voter/CommentVoter.kt

@@ -18,19 +18,27 @@ class CommentVoter : Voter {
 
     override fun vote(action: ActionI, call: ApplicationCall, subject: Any?): Vote {
         val user = call.user
-        if (action == Action.CREATE && user != null) {
+
+        if (subject !is Comment<*> ) {
+            return Vote.DENIED
+        }
+
+        if (action == Action.CREATE) {
+            if (user == null) {
+                return Vote.DENIED
+            }
+            if (subject.createdBy.user.id != user.id) {
+                return Vote.DENIED
+            }
             return Vote.GRANTED
         }
 
         if (action == Action.VIEW) {
-            if (subject is Comment<*>) {
             return if (subject.isDeleted()) Vote.DENIED
             else Vote.GRANTED
         }
-            return Vote.DENIED
-        }
 
-        if (action == Action.UPDATE && user != null && subject is Comment<*> && user.id == subject.createdBy.user.id) {
+        if (action == Action.UPDATE && user != null && user.id == subject.createdBy.user.id) {
             return Vote.GRANTED
         }
 

src/test/kotlin/fr/dcproject/security/voter/CommentVoterTest.kt

@@ -108,4 +108,40 @@ internal class CommentVoterTest {
             can(CommentVoter.Action.DELETE, it, comment1) `should be` false
         }
     }
+
+    @Test
+    fun `can be create a comment`() = listOf(CommentVoter()).run {
+        mockk<ApplicationCall> {
+            every { user } returns tesla.user
+        }.let {
+            can(CommentVoter.Action.CREATE, it, comment1) `should be` true
+        }
+    }
+
+    @Test
+    fun `can not be create a comment with other creator`() = listOf(CommentVoter()).run {
+        mockk<ApplicationCall> {
+            every { user } returns einstein.user
+        }.let {
+            can(CommentVoter.Action.CREATE, it, comment1) `should be` false
+        }
+    }
+
+    @Test
+    fun `can not be create a comment if is null`() = listOf(CommentVoter()).run {
+        mockk<ApplicationCall> {
+            every { user } returns einstein.user
+        }.let {
+            can(CommentVoter.Action.CREATE, it, null) `should be` false
+        }
+    }
+
+    @Test
+    fun `can not be create a comment if not connected`() = listOf(CommentVoter()).run {
+        mockk<ApplicationCall> {
+            every { user } returns null
+        }.let {
+            can(CommentVoter.Action.CREATE, it, comment1) `should be` false
+        }
+    }
 }