diff --git a/app/controllers/articles_controller.rb b/app/controllers/articles_controller.rb index 55b36df3e..9834c6734 100644 --- a/app/controllers/articles_controller.rb +++ b/app/controllers/articles_controller.rb @@ -17,7 +17,7 @@ class ArticlesController < ApplicationController # # I still want to enable this, but first want to get things mostly conformant with # existing expectations. Note, in config/application.rb, we're rescuing the below - # excpetion as though it was a Pundit::NotAuthorizedError. + # exception as though it was a Pundit::NotAuthorizedError. # # The difference being that rescue_from is an ALWAYS use case. Whereas the # config/application.rb uses the config.consider_all_requests_local to determine if diff --git a/app/controllers/comments_controller.rb b/app/controllers/comments_controller.rb index 88e54b99b..3fa54cd5b 100644 --- a/app/controllers/comments_controller.rb +++ b/app/controllers/comments_controller.rb @@ -82,11 +82,15 @@ class CommentsController < ApplicationController message = @comment.errors_as_sentence render json: { error: message }, status: :unprocessable_entity end + # See https://github.com/forem/forem/pull/5485#discussion_r366056925 # for details as to why this is necessary rescue ModerationUnauthorizedError => e render json: { error: e.message }, status: :unprocessable_entity - rescue Pundit::NotAuthorizedError, RateLimitChecker::LimitReached + rescue Pundit::NotAuthorizedError => e + message = I18n.t("comments_controller.create.authorization_error", error: e) + render json: { error: message }, status: :unauthorized + rescue RateLimitChecker::LimitReached raise rescue StandardError => e skip_authorization diff --git a/config/locales/controllers/en.yml b/config/locales/controllers/en.yml index 0e6217cd2..fcb5f6e94 100644 --- a/config/locales/controllers/en.yml +++ b/config/locales/controllers/en.yml @@ -13,6 +13,7 @@ en: create: success: created failure: comment already exists + authorization_error: Your privileges have been suspended. delete: error: Something went wrong; Comment NOT deleted. notice: Comment was successfully deleted. diff --git a/config/locales/controllers/fr.yml b/config/locales/controllers/fr.yml index 613e0e583..1996c5775 100644 --- a/config/locales/controllers/fr.yml +++ b/config/locales/controllers/fr.yml @@ -13,6 +13,7 @@ fr: create: success: created failure: comment already exists + authorization_error: Your privileges have been suspended. delete: error: Something went wrong; Comment NOT deleted. notice: Comment was successfully deleted. diff --git a/spec/requests/comments_spec.rb b/spec/requests/comments_spec.rb index 2a2821b7a..0ee817059 100644 --- a/spec/requests/comments_spec.rb +++ b/spec/requests/comments_spec.rb @@ -319,6 +319,18 @@ RSpec.describe "Comments", type: :request do } end + context "when a user is coment_suspended" do + before do + sign_in user + user.add_role(:comment_suspended) + end + + it "returns not authorized" do + post "/comments", params: base_comment_params + expect(response).to have_http_status(:unauthorized) + end + end + context "when part of field test" do before do sign_in user