Fix logic error with creating comment block (#4566)

* Fix logic error with creating comment block

* Add additional test for more exercising

app/controllers/comments_controller.rb

@@ -47,12 +47,13 @@ class CommentsController < ApplicationController
   # POST /comments
   # POST /comments.json
   def create
-    authorize Comment
     raise if RateLimitChecker.new(current_user).limit_by_action("comment_creation")
 
     @comment = Comment.new(permitted_attributes(Comment))
     @comment.user_id = current_user.id
 
+    authorize @comment
+
     if @comment.save
       current_user.update(checked_code_of_conduct: true) if params[:checked_code_of_conduct].present? && !current_user.checked_code_of_conduct
 

spec/requests/comments_create_spec.rb

@@ -2,6 +2,7 @@ require "rails_helper"
 
 RSpec.describe "CommentsCreate", type: :request do
   let(:user) { create(:user) }
+  let(:blocker) { create(:user) }
   let(:article) { create(:article, user_id: user.id) }
 
   before do
@@ -23,4 +24,30 @@ RSpec.describe "CommentsCreate", type: :request do
     }
     expect(NotificationSubscription.last.notifiable).to eq(Comment.last)
   end
+
+  context "when user is posting on an author that blocks user" do
+    it "returns unauthorized" do
+      create(:user_block, blocker: blocker, blocked: user, config: "default")
+      user.update(blocked_by_count: 1)
+      blocker_article = create(:article, user_id: blocker.id)
+      expect do
+        post "/comments", params: {
+          comment: { body_markdown: "something", commentable_id: blocker_article.id, commentable_type: "Article" }
+        }
+      end.to raise_error(Pundit::NotAuthorizedError)
+    end
+  end
+
+  context "when user is posting on an author that does not block user, but the user has been blocked elsewhere" do
+    it "returns unauthorized" do
+      user.update(blocked_by_count: 1)
+      blocker_article = create(:article, user_id: blocker.id)
+      post "/comments", params: {
+        comment: { body_markdown: "something allowed", commentable_id: blocker_article.id, commentable_type: "Article" }
+      }
+      new_comment = Comment.last
+      expect(new_comment.body_markdown).to eq("something allowed")
+      expect(new_comment.id).not_to eq(nil)
+    end
+  end
 end