chore: Ensure comment data is validated before persisting (#6322)

Fix flash on render of comment create

server/routes/api/comments/comments.test.ts

@@ -16,6 +16,7 @@ describe("#comments.list", () => {
     expect(res.status).toEqual(401);
     expect(body).toMatchSnapshot();
   });
+
   it("should return all comments for a document", async () => {
     const team = await buildTeam();
     const user = await buildUser({ teamId: team.id });
@@ -42,6 +43,7 @@ describe("#comments.list", () => {
     expect(body.policies.length).toEqual(1);
     expect(body.policies[0].abilities.read).toEqual(true);
   });
+
   it("should return all comments for a collection", async () => {
     const team = await buildTeam();
     const user = await buildUser({ teamId: team.id });
@@ -73,6 +75,7 @@ describe("#comments.list", () => {
     expect(body.policies.length).toEqual(1);
     expect(body.policies[0].abilities.read).toEqual(true);
   });
+
   it("should return all comments", async () => {
     const team = await buildTeam();
     const user = await buildUser({ teamId: team.id });
@@ -121,3 +124,83 @@ describe("#comments.list", () => {
     expect(body.policies[1].abilities.read).toEqual(true);
   });
 });
+
+describe("#comments.create", () => {
+  it("should require authentication", async () => {
+    const res = await server.post("/api/comments.create");
+    const body = await res.json();
+    expect(res.status).toEqual(401);
+    expect(body).toMatchSnapshot();
+  });
+
+  it("should create a comment", async () => {
+    const team = await buildTeam();
+    const user = await buildUser({ teamId: team.id });
+    const document = await buildDocument({
+      userId: user.id,
+      teamId: user.teamId,
+    });
+
+    const comment = await buildComment({
+      userId: user.id,
+      teamId: team.id,
+      documentId: document.id,
+    });
+
+    const res = await server.post("/api/comments.create", {
+      body: {
+        token: user.getJwtToken(),
+        documentId: document.id,
+        data: comment.data,
+      },
+    });
+    const body = await res.json();
+
+    expect(res.status).toEqual(200);
+    expect(body.data.data).toEqual(comment.data);
+    expect(body.policies.length).toEqual(1);
+    expect(body.policies[0].abilities.read).toEqual(true);
+    expect(body.policies[0].abilities.update).toEqual(true);
+    expect(body.policies[0].abilities.delete).toEqual(true);
+  });
+
+  it("should not allow empty comment data", async () => {
+    const team = await buildTeam();
+    const user = await buildUser({ teamId: team.id });
+    const document = await buildDocument({
+      userId: user.id,
+      teamId: user.teamId,
+    });
+
+    const res = await server.post("/api/comments.create", {
+      body: {
+        token: user.getJwtToken(),
+        documentId: document.id,
+        data: null,
+      },
+    });
+
+    expect(res.status).toEqual(400);
+  });
+
+  it("should not allow invalid comment data", async () => {
+    const team = await buildTeam();
+    const user = await buildUser({ teamId: team.id });
+    const document = await buildDocument({
+      userId: user.id,
+      teamId: user.teamId,
+    });
+
+    const res = await server.post("/api/comments.create", {
+      body: {
+        token: user.getJwtToken(),
+        documentId: document.id,
+        data: {
+          type: "nonsense",
+        },
+      },
+    });
+
+    expect(res.status).toEqual(400);
+  });
+});