Mods and admins can comment in locked posts (fixes #4116) (#4488)

* Mods and admins can comment in locked posts (fixes #4116)

* fmt

* fix

* fix test

api_tests/src/post.spec.ts

@@ -270,8 +270,10 @@ test("Lock a post", async () => {
     post => !!post && post.post.locked,
   );
 
-  // Try to make a new comment there, on alpha
-  await expect(createComment(alpha, alphaPost1.post.id)).rejects.toStrictEqual(
+  // Try to make a new comment there, on alpha. For this we need to create a normal
+  // user account because admins/mods can comment in locked posts.
+  let user = await registerUser(alpha, alphaUrl);
+  await expect(createComment(user, alphaPost1.post.id)).rejects.toStrictEqual(
     Error("locked"),
   );
 
@@ -290,7 +292,7 @@ test("Lock a post", async () => {
   expect(alphaPost2.post.locked).toBe(false);
 
   // Try to create a new comment, on alpha
-  let commentAlpha = await createComment(alpha, alphaPost1.post.id);
+  let commentAlpha = await createComment(user, alphaPost1.post.id);
   expect(commentAlpha).toBeDefined();
 });
 

crates/api_crud/src/comment/create.rs

@@ -10,6 +10,7 @@ use lemmy_api_common::{
     check_post_deleted_or_removed,
     generate_local_apub_endpoint,
     get_post,
+    is_mod_or_admin,
     local_site_to_slur_regex,
     process_markdown,
     EndpointType,
@@ -55,7 +56,10 @@ pub async fn create_comment(
   check_post_deleted_or_removed(&post)?;
 
   // Check if post is locked, no new comments
-  if post.locked {
+  let is_mod_or_admin = is_mod_or_admin(&mut context.pool(), &local_user_view.person, community_id)
+    .await
+    .is_ok();
+  if post.locked && !is_mod_or_admin {
     Err(LemmyErrorType::Locked)?
   }
 

crates/apub/src/objects/comment.rs

@@ -18,7 +18,7 @@ use activitypub_federation::{
 use chrono::{DateTime, Utc};
 use lemmy_api_common::{
   context::LemmyContext,
-  utils::{local_site_opt_to_slur_regex, process_markdown},
+  utils::{is_mod_or_admin, local_site_opt_to_slur_regex, process_markdown},
 };
 use lemmy_db_schema::{
   source::{
@@ -142,7 +142,11 @@ impl Object for ApubComment {
     verify_is_remote_object(note.id.inner(), context.settings())?;
     verify_person_in_community(&note.attributed_to, &community, context).await?;
     let (post, _) = note.get_parents(context).await?;
-    if post.locked {
+    let creator = note.attributed_to.dereference(context).await?;
+    let is_mod_or_admin = is_mod_or_admin(&mut context.pool(), &creator, community.id)
+      .await
+      .is_ok();
+    if post.locked && !is_mod_or_admin {
       Err(LemmyErrorType::PostIsLocked)?
     } else {
       Ok(())