feat(campaign): open the discussion to any logged-in user

src/mutations/comment/putComment.ts

@@ -77,7 +77,6 @@ const resolver: GQLMutationResolvers['putComment'] = async (
       commentService,
       paymentService,
       articleService,
-      campaignService,
       notificationService,
       userService,
       connections,
@@ -309,22 +308,9 @@ const resolver: GQLMutationResolvers['putComment'] = async (
     }
   }
 
-  // campaign discussion is public to read, but only succeeded participants
-  // (or the campaign organizers/managers) may comment
-  if (campaign) {
-    const isParticipant = await campaignService.isParticipant(
-      campaign.id,
-      viewer.id
-    )
-    const isOrganizer =
-      campaign.creatorId === viewer.id ||
-      (campaign.organizerIds ?? []).includes(viewer.id) ||
-      (campaign.managerIds ?? []).includes(viewer.id)
-
-    if (!isParticipant && !isOrganizer) {
-      throw new ForbiddenError('only campaign participants have the permission')
-    }
-  }
+  // campaign discussion is public to read; any logged-in user may comment.
+  // (relaxed from the previous participant-only restriction — basic user-state
+  // and campaign-state guards are still enforced above.)
 
   // check whether viewer is blocked by target author (skip when no single author,
   // e.g. campaign discussion)

src/types/__test__/2/campaignComment.test.ts

@@ -219,22 +219,33 @@ describe('put campaignDiscussion comment', () => {
     }
   })
 
-  test('non-participant can not comment', async () => {
-    const { errors } = await putCampaignComment(
+  // the discussion is open to every logged-in user (the participant-only
+  // restriction was relaxed), so non-participant / pending / rejected may comment
+  test('non-participant can comment', async () => {
+    const { errors, data } = await putCampaignComment(
       nonParticipantId,
       campaignGlobalId
     )
-    expect(errors?.[0].extensions.code).toBe('FORBIDDEN')
+    expect(errors).toBeUndefined()
+    expect(data.putComment.id).toBeDefined()
   })
 
-  test('pending applicant can not comment', async () => {
-    const { errors } = await putCampaignComment(pendingId, campaignGlobalId)
-    expect(errors?.[0].extensions.code).toBe('FORBIDDEN')
+  test('pending applicant can comment', async () => {
+    const { errors, data } = await putCampaignComment(
+      pendingId,
+      campaignGlobalId
+    )
+    expect(errors).toBeUndefined()
+    expect(data.putComment.id).toBeDefined()
   })
 
-  test('rejected applicant can not comment', async () => {
-    const { errors } = await putCampaignComment(rejectedId, campaignGlobalId)
-    expect(errors?.[0].extensions.code).toBe('FORBIDDEN')
+  test('rejected applicant can comment', async () => {
+    const { errors, data } = await putCampaignComment(
+      rejectedId,
+      campaignGlobalId
+    )
+    expect(errors).toBeUndefined()
+    expect(data.putComment.id).toBeDefined()
   })
 
   test('can not comment on archived campaign', async () => {