fix(comment): dismiss owner/admin authz + atomic conditional delete + 404-only onError (#329 review)

Maintainer escalation decision (B) + reviewer findings on the ephemeral- suggestion PR. Authz (decision B): POST /comments/dismiss-suggestion now gates the destructive branch on owner-OR-space-admin, mirroring POST /comments/delete exactly (same SpaceCaslAction.Manage / SpaceCaslSubject.Settings, same owner short-circuit, same ForbiddenException). A non-owner non-admin who tries to dismiss another's childless suggestion gets Forbidden before the service runs. Apply stays on canEdit (accepting an edit is the editor's semantics), unchanged. F1 [blocking] — atomic conditional delete closes the hasChildren→delete race. New repo `deleteCommentIfChildless(id)` runs a single `DELETE FROM comments WHERE id=:id AND NOT EXISTS (SELECT 1 FROM comments child WHERE child.parent_comment_id = comments.id)` (verified by compiling the Kysely expression to SQL — the correlated subquery references the OUTER comments.id). deleteEphemeralSuggestion strips the mark first, then the conditional delete: if it removed the row → commentDeleted + outcome 'deleted'; if a reply raced in (0 rows) → fall back to resolveComment (outcome 'resolved') so the discussion and the new reply survive. No reply can be cascade-deleted anymore. F2 [warning] — the apply/dismiss onError success-noop is narrowed from 404||400 to 404 ONLY. A 400 means the comment is ALIVE (apply's 400 = the thread was resolved-not-applied), so it now shows a real error (surfacing the server message) and KEEPS the comment in cache instead of a false "applied" + dropping a live thread. F3 [suggestion] — the 404-race client tests assert the success toast fired. Tests: server — dismiss authz (owner ok / non-owner-non-admin Forbidden / space-admin ok), the delete→resolve race (hasChildren=false but conditional delete returns 0 → resolve, no commentDeleted), delete-path asserts switched to deleteCommentIfChildless; client — apply-400 and dismiss-400 (kept in cache, red, not success) + the toast assertions. server tsc clean, comment+collaboration jest green; client tsc clean, comment vitest 54 passed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-04 18:22:35 +03:00
parent 8d8ecaed82
commit e6d8eda8e5
8 changed files with 357 additions and 44 deletions
@@ -516,8 +516,10 @@ export class CommentService {
      return { ...updatedComment, outcome: 'resolved' };
    }

-    // Ephemeral: no replies → the suggestion vanishes entirely.
-    await this.deleteEphemeralSuggestion(comment, user);
+    // Ephemeral: no replies → the suggestion vanishes entirely. The atomic
+    // conditional delete may still fall back to a resolve if a reply raced in
+    // (see deleteEphemeralSuggestion), so the outcome is whatever it settled on.
+    const settled = await this.deleteEphemeralSuggestion(comment, user, provenance);
    this.auditService.log({
      event: AuditEvent.COMMENT_SUGGESTION_DISMISSED,
      resourceType: AuditResource.COMMENT,
@@ -525,7 +527,7 @@ export class CommentService {
      spaceId: comment.spaceId,
      metadata: { pageId: comment.pageId },
    });
-    return { ...comment, outcome: 'deleted' };
+    return settled;
  }

  /**
@@ -592,7 +594,9 @@ export class CommentService {
    // the comment is redundant. Hard-delete it and strip its inline anchor. We
    // deliberately do NOT write the applied stamps first (the row is about to be
    // deleted); the audit event still records that the suggestion was applied.
-    await this.deleteEphemeralSuggestion(comment, user);
+    // The delete is atomic-conditional: if a reply raced in after the
+    // hasChildren read, it falls back to resolving instead (outcome 'resolved').
+    const settled = await this.deleteEphemeralSuggestion(comment, user, provenance);

    this.auditService.log({
      event: AuditEvent.COMMENT_SUGGESTION_APPLIED,
@@ -602,13 +606,13 @@ export class CommentService {
      metadata: { pageId: comment.pageId },
    });

-    return { ...comment, outcome: 'deleted' };
+    return settled;
  }

  /**
-   * Hard-delete an ephemeral suggestion comment and remove its inline `comment`
-   * anchor mark from the collaborative document, then broadcast the deletion.
-   * Shared by the apply/dismiss no-replies branches (#329).
+   * Settle an ephemeral suggestion whose thread looked childless: remove its
+   * inline `comment` anchor mark, then ATOMICALLY hard-delete the row only if it
+   * is still childless. Shared by the apply/dismiss no-replies branches (#329).
   *
   * ORDER MATTERS: the anchor mark is removed FIRST and FATALLY (mirrors
   * applySuggestion, which mutates the doc before writing the DB). The row
@@ -618,19 +622,51 @@ export class CommentService {
   * anchor pointing at a comment that no longer exists (the exact data-integrity
   * bug #329 targets). Let the exception propagate (→ 5xx); the operation is
   * then repeatable with row + mark still consistent.
+   *
+   * RACE (#338 F1): the caller read `hasChildren` BEFORE the (slow) mark
+   * removal, so a reply can land in that window. `comments.parent_comment_id` is
+   * ON DELETE CASCADE, so an unconditional delete here would cascade-destroy the
+   * just-added reply forever. Instead we use `deleteCommentIfChildless`, which
+   * re-checks childlessness inside the delete statement. If it removes the row
+   * (outcome 'deleted') we broadcast the deletion as before. If it removes 0
+   * rows (a reply interleaved) we do NOT hard-delete — we resolve the thread
+   * instead (outcome 'resolved'), preserving the discussion and the new reply.
+   * The anchor mark is already gone by then, an accepted degradation: the thread
+   * lands in the resolved tab without its inline highlight — far better than
+   * losing a reply.
   */
  private async deleteEphemeralSuggestion(
    comment: Comment,
    user: User,
-  ): Promise<void> {
+    provenance?: AuthProvenanceData,
+  ): Promise<Comment & { outcome: SuggestionOutcome }> {
    await this.deleteCommentMark(comment, user);
-    await this.commentRepo.deleteComment(comment.id);

-    this.wsService.emitCommentEvent(comment.spaceId, comment.pageId, {
-      operation: 'commentDeleted',
-      pageId: comment.pageId,
-      commentId: comment.id,
-    });
+    const deletedRows = await this.commentRepo.deleteCommentIfChildless(
+      comment.id,
+    );
+
+    if (deletedRows > 0) {
+      this.wsService.emitCommentEvent(comment.spaceId, comment.pageId, {
+        operation: 'commentDeleted',
+        pageId: comment.pageId,
+        commentId: comment.id,
+      });
+      return { ...comment, outcome: 'deleted' };
+    }
+
+    // A reply interleaved between the hasChildren read and this delete, so the
+    // conditional delete matched nothing. Preserve the discussion + the new
+    // reply by resolving the thread instead of hard-deleting it. resolveComment
+    // handles the resolve patch, its ws broadcast and the resolve notification;
+    // its collab call is best-effort, so the already-stripped mark is fine.
+    const resolvedComment = await this.resolveComment(
+      comment,
+      true,
+      user,
+      provenance,
+    );
+    return { ...resolvedComment, outcome: 'resolved' };
  }

  /**