diff --git a/Api.SeaHavenIndustries/Controllers/WorkOrderController.cs b/Api.SeaHavenIndustries/Controllers/WorkOrderController.cs index db2b7fe..3231002 100644 --- a/Api.SeaHavenIndustries/Controllers/WorkOrderController.cs +++ b/Api.SeaHavenIndustries/Controllers/WorkOrderController.cs @@ -296,9 +296,8 @@ namespace Api.SeaHavenIndustries.Controllers try { var actorId = User.FindFirstValue(ClaimTypes.NameIdentifier); - var isAdmin = User.IsInRole("Admin"); var comment = await _workOrderCommentService.UpdateCommentAsync( - id, commentId, request, actorId, isAdmin); + id, commentId, request, actorId); return Ok(comment); } catch (WorkOrderBoardValidationException ex) when (ex.Code == "NotFound") diff --git a/SeaHaven.Services/Implementation/WorkOrderCommentService.cs b/SeaHaven.Services/Implementation/WorkOrderCommentService.cs index aa17d38..e0ad136 100644 --- a/SeaHaven.Services/Implementation/WorkOrderCommentService.cs +++ b/SeaHaven.Services/Implementation/WorkOrderCommentService.cs @@ -65,8 +65,7 @@ namespace SeaHaven.Services.Implementation int workOrderId, int commentId, WorkOrderCommentCreateDto request, - string? actorId, - bool isAdmin) + string? actorId) { var workOrder = await _detailData.GetWorkOrderForMediaAsync(workOrderId); if (workOrder == null) @@ -89,7 +88,7 @@ namespace SeaHaven.Services.Implementation var isAuthor = !string.IsNullOrWhiteSpace(actorId) && string.Equals(comment.UserId, actorId, StringComparison.Ordinal); - if (!isAuthor && !isAdmin) + if (!isAuthor) throw new WorkOrderBoardValidationException("Forbidden", "You are not allowed to edit this comment."); comment.Commenttext = request.Text.Trim(); diff --git a/SeaHaven.Services/Interfaces/IWorkOrderCommentService.cs b/SeaHaven.Services/Interfaces/IWorkOrderCommentService.cs index 5e6a4ea..3c5d27c 100644 --- a/SeaHaven.Services/Interfaces/IWorkOrderCommentService.cs +++ b/SeaHaven.Services/Interfaces/IWorkOrderCommentService.cs @@ -11,7 +11,6 @@ namespace SeaHaven.Services.Interfaces int workOrderId, int commentId, WorkOrderCommentCreateDto request, - string? actorId, - bool isAdmin); + string? actorId); } } diff --git a/SeaHavenIndustries.Tests/WorkOrderPhase6Tests.cs b/SeaHavenIndustries.Tests/WorkOrderPhase6Tests.cs index 6133102..b657424 100644 --- a/SeaHavenIndustries.Tests/WorkOrderPhase6Tests.cs +++ b/SeaHavenIndustries.Tests/WorkOrderPhase6Tests.cs @@ -478,8 +478,7 @@ public class WorkOrderCommentServiceTests 1, comment.Id, new WorkOrderCommentCreateDto { Text = " Updated note " }, - "user-author", - isAdmin: false); + "user-author"); Assert.Equal("Updated note", result.Text); Assert.Equal("user-author", result.AuthorId); @@ -487,23 +486,22 @@ public class WorkOrderCommentServiceTests } [Fact] - public async Task UpdateComment_Admin_CanEditOthers() + public async Task UpdateComment_AdminNonAuthor_ThrowsForbidden() { var (_, service, comment) = await SeedEditableCommentAsync(); - var result = await service.UpdateCommentAsync( - 1, - comment.Id, - new WorkOrderCommentCreateDto { Text = "Admin edit" }, - "admin-user", - isAdmin: true); + var ex = await Assert.ThrowsAsync(() => + service.UpdateCommentAsync( + 1, + comment.Id, + new WorkOrderCommentCreateDto { Text = "Admin edit" }, + "admin-user")); - Assert.Equal("Admin edit", result.Text); - Assert.Equal("user-author", result.AuthorId); + Assert.Equal("Forbidden", ex.Code); } [Fact] - public async Task UpdateComment_NonAuthorNonAdmin_ThrowsForbidden() + public async Task UpdateComment_NonAuthor_ThrowsForbidden() { var (_, service, comment) = await SeedEditableCommentAsync(); @@ -512,8 +510,7 @@ public class WorkOrderCommentServiceTests 1, comment.Id, new WorkOrderCommentCreateDto { Text = "Nope" }, - "other-user", - isAdmin: false)); + "other-user")); Assert.Equal("Forbidden", ex.Code); } @@ -530,8 +527,7 @@ public class WorkOrderCommentServiceTests 1, comment.Id, new WorkOrderCommentCreateDto { Text = "Nope" }, - "user-author", - isAdmin: false)); + "user-author")); Assert.Equal("NotEditable", ex.Code); } @@ -546,8 +542,7 @@ public class WorkOrderCommentServiceTests 1, comment.Id, new WorkOrderCommentCreateDto { Text = "Nope" }, - "user-author", - isAdmin: false)); + "user-author")); Assert.Equal("ReadOnly", ex.Code); } @@ -564,8 +559,7 @@ public class WorkOrderCommentServiceTests 2, comment.Id, new WorkOrderCommentCreateDto { Text = "Nope" }, - "user-author", - isAdmin: false)); + "user-author")); Assert.Equal("NotFound", ex.Code); }