chore: Ensure comment data is validated before persisting (#6322)

Fix flash on render of comment create

server/routes/api/comments/__snapshots__/comments.test.ts.snap

@@ -1,5 +1,14 @@
 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
+exports[`#comments.create should require authentication 1`] = `
+{
+  "error": "authentication_required",
+  "message": "Authentication required",
+  "ok": false,
+  "status": 401,
+}
+`;
+
 exports[`#comments.list should require authentication 1`] = `
 {
   "error": "authentication_required",

server/routes/api/comments/comments.test.ts

@@ -16,6 +16,7 @@ describe("#comments.list", () => {
     expect(res.status).toEqual(401);
     expect(body).toMatchSnapshot();
   });
+
   it("should return all comments for a document", async () => {
     const team = await buildTeam();
     const user = await buildUser({ teamId: team.id });
@@ -42,6 +43,7 @@ describe("#comments.list", () => {
     expect(body.policies.length).toEqual(1);
     expect(body.policies[0].abilities.read).toEqual(true);
   });
+
   it("should return all comments for a collection", async () => {
     const team = await buildTeam();
     const user = await buildUser({ teamId: team.id });
@@ -73,6 +75,7 @@ describe("#comments.list", () => {
     expect(body.policies.length).toEqual(1);
     expect(body.policies[0].abilities.read).toEqual(true);
   });
+
   it("should return all comments", async () => {
     const team = await buildTeam();
     const user = await buildUser({ teamId: team.id });
@@ -121,3 +124,83 @@ describe("#comments.list", () => {
     expect(body.policies[1].abilities.read).toEqual(true);
   });
 });
+
+describe("#comments.create", () => {
+  it("should require authentication", async () => {
+    const res = await server.post("/api/comments.create");
+    const body = await res.json();
+    expect(res.status).toEqual(401);
+    expect(body).toMatchSnapshot();
+  });
+
+  it("should create a comment", async () => {
+    const team = await buildTeam();
+    const user = await buildUser({ teamId: team.id });
+    const document = await buildDocument({
+      userId: user.id,
+      teamId: user.teamId,
+    });
+
+    const comment = await buildComment({
+      userId: user.id,
+      teamId: team.id,
+      documentId: document.id,
+    });
+
+    const res = await server.post("/api/comments.create", {
+      body: {
+        token: user.getJwtToken(),
+        documentId: document.id,
+        data: comment.data,
+      },
+    });
+    const body = await res.json();
+
+    expect(res.status).toEqual(200);
+    expect(body.data.data).toEqual(comment.data);
+    expect(body.policies.length).toEqual(1);
+    expect(body.policies[0].abilities.read).toEqual(true);
+    expect(body.policies[0].abilities.update).toEqual(true);
+    expect(body.policies[0].abilities.delete).toEqual(true);
+  });
+
+  it("should not allow empty comment data", async () => {
+    const team = await buildTeam();
+    const user = await buildUser({ teamId: team.id });
+    const document = await buildDocument({
+      userId: user.id,
+      teamId: user.teamId,
+    });
+
+    const res = await server.post("/api/comments.create", {
+      body: {
+        token: user.getJwtToken(),
+        documentId: document.id,
+        data: null,
+      },
+    });
+
+    expect(res.status).toEqual(400);
+  });
+
+  it("should not allow invalid comment data", async () => {
+    const team = await buildTeam();
+    const user = await buildUser({ teamId: team.id });
+    const document = await buildDocument({
+      userId: user.id,
+      teamId: user.teamId,
+    });
+
+    const res = await server.post("/api/comments.create", {
+      body: {
+        token: user.getJwtToken(),
+        documentId: document.id,
+        data: {
+          type: "nonsense",
+        },
+      },
+    });
+
+    expect(res.status).toEqual(400);
+  });
+});

server/routes/api/comments/schema.ts

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import BaseSchema from "@server/routes/api/BaseSchema";
+import { BaseSchema, ProsemirrorSchema } from "@server/routes/api/schema";
 
 const CollectionsSortParamsSchema = z.object({
   /** Specifies the attributes by which documents will be sorted in the list */
@@ -27,7 +27,7 @@ export const CommentsCreateSchema = BaseSchema.extend({
     parentCommentId: z.string().uuid().optional(),
 
     /** Create comment with this data */
-    data: z.any(),
+    data: ProsemirrorSchema,
   }),
 });
 
@@ -39,7 +39,7 @@ export const CommentsUpdateSchema = BaseSchema.extend({
     id: z.string().uuid(),
 
     /** Update comment with this data */
-    data: z.any(),
+    data: ProsemirrorSchema,
   }),
 });