chore: Ensure comment data is validated before persisting (#6322)

Fix flash on render of comment create

app/stores/CommentsStore.ts

@@ -7,9 +7,16 @@ import Document from "~/models/Document";
 import { PaginationParams } from "~/types";
 import { client } from "~/utils/ApiClient";
 import RootStore from "./RootStore";
-import Store from "./base/Store";
+import Store, { RPCAction } from "./base/Store";
 
 export default class CommentsStore extends Store<Comment> {
+  actions = [
+    RPCAction.List,
+    RPCAction.Create,
+    RPCAction.Update,
+    RPCAction.Delete,
+  ];
+
   constructor(rootStore: RootStore) {
     super(rootStore, Comment);
   }

app/stores/base/Store.ts

@@ -157,9 +157,11 @@ export default abstract class Store<T extends Model> {
         ...options,
       });
 
-      invariant(res?.data, "Data should be available");
+      return runInAction(`create#${this.modelName}`, () => {
-      this.addPolicies(res.policies);
+        invariant(res?.data, "Data should be available");
-      return this.add(res.data);
+        this.addPolicies(res.policies);
+        return this.add(res.data);
+      });
     } finally {
       this.isSaving = false;
     }
@@ -182,9 +184,11 @@ export default abstract class Store<T extends Model> {
         ...options,
       });
 
-      invariant(res?.data, "Data should be available");
+      return runInAction(`update#${this.modelName}`, () => {
-      this.addPolicies(res.policies);
+        invariant(res?.data, "Data should be available");
-      return this.add(res.data);
+        this.addPolicies(res.policies);
+        return this.add(res.data);
+      });
     } finally {
       this.isSaving = false;
     }
@@ -229,9 +233,12 @@ export default abstract class Store<T extends Model> {
       const res = await client.post(`/${this.apiEndpoint}.info`, {
         id,
       });
-      invariant(res?.data, "Data should be available");
+
-      this.addPolicies(res.policies);
+      return runInAction(`info#${this.modelName}`, () => {
-      return this.add(res.data);
+        invariant(res?.data, "Data should be available");
+        this.addPolicies(res.policies);
+        return this.add(res.data);
+      });
     } catch (err) {
       if (err instanceof AuthorizationError || err instanceof NotFoundError) {
         this.remove(id);

server/routes/api/BaseSchema.ts

@@ -1,10 +0,0 @@
-import formidable from "formidable";
-import { z } from "zod";
-
-const BaseSchema = z.object({
-  body: z.unknown(),
-  query: z.unknown(),
-  file: z.custom<formidable.File>().optional(),
-});
-
-export default BaseSchema;

server/routes/api/apiKeys/schema.ts

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import BaseSchema from "@server/routes/api/BaseSchema";
+import { BaseSchema } from "@server/routes/api/schema";
 
 export const APIKeysCreateSchema = BaseSchema.extend({
   body: z.object({

server/routes/api/attachments/schema.ts

@@ -1,7 +1,7 @@
 import isEmpty from "lodash/isEmpty";
 import { z } from "zod";
 import { AttachmentPreset } from "@shared/types";
-import BaseSchema from "@server/routes/api/BaseSchema";
+import { BaseSchema } from "@server/routes/api/schema";
 
 export const AttachmentsCreateSchema = BaseSchema.extend({
   body: z.object({

server/routes/api/auth/schema.ts

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import BaseSchema from "../BaseSchema";
+import { BaseSchema } from "../schema";
 
 export const AuthConfigSchema = BaseSchema;
 

server/routes/api/authenticationProviders/schema.ts

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import BaseSchema from "@server/routes/api/BaseSchema";
+import { BaseSchema } from "@server/routes/api/schema";
 
 export const AuthenticationProvidersInfoSchema = BaseSchema.extend({
   body: z.object({

server/routes/api/collections/schema.ts

@@ -5,7 +5,7 @@ import { CollectionPermission, FileOperationFormat } from "@shared/types";
 import { colorPalette } from "@shared/utils/collections";
 import { Collection } from "@server/models";
 import { ValidateColor, ValidateIcon, ValidateIndex } from "@server/validation";
-import BaseSchema from "../BaseSchema";
+import { BaseSchema } from "../schema";
 
 export const CollectionsCreateSchema = BaseSchema.extend({
   body: z.object({

server/routes/api/comments/__snapshots__/comments.test.ts.snap

@@ -1,5 +1,14 @@
 // Jest Snapshot v1, https://goo.gl/fbAQLP
 
+exports[`#comments.create should require authentication 1`] = `
+{
+  "error": "authentication_required",
+  "message": "Authentication required",
+  "ok": false,
+  "status": 401,
+}
+`;
+
 exports[`#comments.list should require authentication 1`] = `
 {
   "error": "authentication_required",

server/routes/api/comments/comments.test.ts

@@ -16,6 +16,7 @@ describe("#comments.list", () => {
     expect(res.status).toEqual(401);
     expect(body).toMatchSnapshot();
   });
+
   it("should return all comments for a document", async () => {
     const team = await buildTeam();
     const user = await buildUser({ teamId: team.id });
@@ -42,6 +43,7 @@ describe("#comments.list", () => {
     expect(body.policies.length).toEqual(1);
     expect(body.policies[0].abilities.read).toEqual(true);
   });
+
   it("should return all comments for a collection", async () => {
     const team = await buildTeam();
     const user = await buildUser({ teamId: team.id });
@@ -73,6 +75,7 @@ describe("#comments.list", () => {
     expect(body.policies.length).toEqual(1);
     expect(body.policies[0].abilities.read).toEqual(true);
   });
+
   it("should return all comments", async () => {
     const team = await buildTeam();
     const user = await buildUser({ teamId: team.id });
@@ -121,3 +124,83 @@ describe("#comments.list", () => {
     expect(body.policies[1].abilities.read).toEqual(true);
   });
 });
+
+describe("#comments.create", () => {
+  it("should require authentication", async () => {
+    const res = await server.post("/api/comments.create");
+    const body = await res.json();
+    expect(res.status).toEqual(401);
+    expect(body).toMatchSnapshot();
+  });
+
+  it("should create a comment", async () => {
+    const team = await buildTeam();
+    const user = await buildUser({ teamId: team.id });
+    const document = await buildDocument({
+      userId: user.id,
+      teamId: user.teamId,
+    });
+
+    const comment = await buildComment({
+      userId: user.id,
+      teamId: team.id,
+      documentId: document.id,
+    });
+
+    const res = await server.post("/api/comments.create", {
+      body: {
+        token: user.getJwtToken(),
+        documentId: document.id,
+        data: comment.data,
+      },
+    });
+    const body = await res.json();
+
+    expect(res.status).toEqual(200);
+    expect(body.data.data).toEqual(comment.data);
+    expect(body.policies.length).toEqual(1);
+    expect(body.policies[0].abilities.read).toEqual(true);
+    expect(body.policies[0].abilities.update).toEqual(true);
+    expect(body.policies[0].abilities.delete).toEqual(true);
+  });
+
+  it("should not allow empty comment data", async () => {
+    const team = await buildTeam();
+    const user = await buildUser({ teamId: team.id });
+    const document = await buildDocument({
+      userId: user.id,
+      teamId: user.teamId,
+    });
+
+    const res = await server.post("/api/comments.create", {
+      body: {
+        token: user.getJwtToken(),
+        documentId: document.id,
+        data: null,
+      },
+    });
+
+    expect(res.status).toEqual(400);
+  });
+
+  it("should not allow invalid comment data", async () => {
+    const team = await buildTeam();
+    const user = await buildUser({ teamId: team.id });
+    const document = await buildDocument({
+      userId: user.id,
+      teamId: user.teamId,
+    });
+
+    const res = await server.post("/api/comments.create", {
+      body: {
+        token: user.getJwtToken(),
+        documentId: document.id,
+        data: {
+          type: "nonsense",
+        },
+      },
+    });
+
+    expect(res.status).toEqual(400);
+  });
+});

server/routes/api/comments/schema.ts

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import BaseSchema from "@server/routes/api/BaseSchema";
+import { BaseSchema, ProsemirrorSchema } from "@server/routes/api/schema";
 
 const CollectionsSortParamsSchema = z.object({
   /** Specifies the attributes by which documents will be sorted in the list */
@@ -27,7 +27,7 @@ export const CommentsCreateSchema = BaseSchema.extend({
     parentCommentId: z.string().uuid().optional(),
 
     /** Create comment with this data */
-    data: z.any(),
+    data: ProsemirrorSchema,
   }),
 });
 
@@ -39,7 +39,7 @@ export const CommentsUpdateSchema = BaseSchema.extend({
     id: z.string().uuid(),
 
     /** Update comment with this data */
-    data: z.any(),
+    data: ProsemirrorSchema,
   }),
 });
 

server/routes/api/cron/schema.ts

@@ -1,6 +1,6 @@
 import isEmpty from "lodash/isEmpty";
 import { z } from "zod";
-import BaseSchema from "../BaseSchema";
+import { BaseSchema } from "../schema";
 
 export const CronSchema = BaseSchema.extend({
   body: z.object({

server/routes/api/developer/schema.ts

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import BaseSchema from "../BaseSchema";
+import { BaseSchema } from "../schema";
 
 export const CreateTestUsersSchema = BaseSchema.extend({
   body: z.object({

server/routes/api/documents/schema.ts

@@ -4,7 +4,7 @@ import isEmpty from "lodash/isEmpty";
 import isUUID from "validator/lib/isUUID";
 import { z } from "zod";
 import { SHARE_URL_SLUG_REGEX } from "@shared/utils/urlHelpers";
-import BaseSchema from "@server/routes/api/BaseSchema";
+import { BaseSchema } from "@server/routes/api/schema";
 
 const DocumentsSortParamsSchema = z.object({
   /** Specifies the attributes by which documents will be sorted in the list */

server/routes/api/events/schema.ts

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import BaseSchema from "@server/routes/api/BaseSchema";
+import { BaseSchema } from "@server/routes/api/schema";
 
 export const EventsListSchema = BaseSchema.extend({
   body: z.object({

server/routes/api/fileOperations/schema.ts

@@ -2,7 +2,7 @@ import isEmpty from "lodash/isEmpty";
 import z from "zod";
 import { FileOperationType } from "@shared/types";
 import { FileOperation } from "@server/models";
-import BaseSchema from "../BaseSchema";
+import { BaseSchema } from "../schema";
 
 const CollectionsSortParamsSchema = z.object({
   /** The attribute to sort by */

server/routes/api/integrations/schema.ts

@@ -2,7 +2,7 @@ import { z } from "zod";
 import { IntegrationType } from "@shared/types";
 import { Integration } from "@server/models";
 import { UserCreatableIntegrationService } from "@server/models/Integration";
-import BaseSchema from "../BaseSchema";
+import { BaseSchema } from "../schema";
 
 export const IntegrationsListSchema = BaseSchema.extend({
   body: z.object({

server/routes/api/notifications/schema.ts

@@ -1,7 +1,7 @@
 import isEmpty from "lodash/isEmpty";
 import { z } from "zod";
 import { NotificationEventType } from "@shared/types";
-import BaseSchema from "../BaseSchema";
+import { BaseSchema } from "../schema";
 
 export const NotificationSettingsCreateSchema = BaseSchema.extend({
   body: z.object({

server/routes/api/pins/schema.ts

@@ -1,7 +1,7 @@
 import isUUID from "validator/lib/isUUID";
 import { z } from "zod";
 import { SLUG_URL_REGEX } from "@shared/utils/urlHelpers";
-import BaseSchema from "../BaseSchema";
+import { BaseSchema } from "../schema";
 
 export const PinsCreateSchema = BaseSchema.extend({
   body: z.object({

server/routes/api/revisions/schema.ts

@@ -1,7 +1,7 @@
 import isEmpty from "lodash/isEmpty";
 import { z } from "zod";
 import { Revision } from "@server/models";
-import BaseSchema from "@server/routes/api/BaseSchema";
+import { BaseSchema } from "@server/routes/api/schema";
 
 export const RevisionsInfoSchema = BaseSchema.extend({
   body: z

server/routes/api/schema.ts

@@ -0,0 +1,21 @@
+import formidable from "formidable";
+import { Node } from "prosemirror-model";
+import { z } from "zod";
+import { ProsemirrorData as TProsemirrorData } from "@shared/types";
+import { schema } from "@server/editor";
+
+export const BaseSchema = z.object({
+  body: z.unknown(),
+  query: z.unknown(),
+  file: z.custom<formidable.File>().optional(),
+});
+
+export const ProsemirrorSchema = z.custom<TProsemirrorData>((val) => {
+  try {
+    const node = Node.fromJSON(schema, val);
+    node.check();
+    return true;
+  } catch {
+    return false;
+  }
+}, "not valid data");

server/routes/api/searches/schema.ts

@@ -1,6 +1,6 @@
 import isEmpty from "lodash/isEmpty";
 import { z } from "zod";
-import BaseSchema from "../BaseSchema";
+import { BaseSchema } from "../schema";
 
 export const SearchesDeleteSchema = BaseSchema.extend({
   body: z.object({

server/routes/api/shares/schema.ts

@@ -3,7 +3,7 @@ import isUUID from "validator/lib/isUUID";
 import { z } from "zod";
 import { SHARE_URL_SLUG_REGEX, SLUG_URL_REGEX } from "@shared/utils/urlHelpers";
 import { Share } from "@server/models";
-import BaseSchema from "../BaseSchema";
+import { BaseSchema } from "../schema";
 
 export const SharesInfoSchema = BaseSchema.extend({
   body: z

server/routes/api/stars/schema.ts

@@ -1,7 +1,7 @@
 import isEmpty from "lodash/isEmpty";
 import { z } from "zod";
 import { ValidateDocumentId, ValidateIndex } from "@server/validation";
-import BaseSchema from "../BaseSchema";
+import { BaseSchema } from "../schema";
 
 export const StarsCreateSchema = BaseSchema.extend({
   body: z

server/routes/api/subscriptions/schema.ts

@@ -1,6 +1,6 @@
 import { z } from "zod";
 import { ValidateDocumentId } from "@server/validation";
-import BaseSchema from "../BaseSchema";
+import { BaseSchema } from "../schema";
 
 export const SubscriptionsListSchema = BaseSchema.extend({
   body: z.object({

server/routes/api/teams/schema.ts

@@ -1,6 +1,6 @@
 import { z } from "zod";
 import { UserRole } from "@shared/types";
-import BaseSchema from "@server/routes/api/BaseSchema";
+import { BaseSchema } from "@server/routes/api/schema";
 
 export const TeamsUpdateSchema = BaseSchema.extend({
   body: z.object({

server/routes/api/urls/schema.ts

@@ -2,7 +2,7 @@ import isNil from "lodash/isNil";
 import { z } from "zod";
 import { isUrl } from "@shared/utils/urls";
 import { ValidateURL } from "@server/validation";
-import BaseSchema from "../BaseSchema";
+import { BaseSchema } from "../schema";
 
 export const UrlsUnfurlSchema = BaseSchema.extend({
   body: z

server/routes/api/users/schema.ts

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import { NotificationEventType, UserPreference, UserRole } from "@shared/types";
 import User from "@server/models/User";
-import BaseSchema from "../BaseSchema";
+import { BaseSchema } from "../schema";
 
 const BaseIdSchema = z.object({
   id: z.string().uuid(),

server/routes/api/views/schema.ts

@@ -1,5 +1,5 @@
 import z from "zod";
-import BaseSchema from "../BaseSchema";
+import { BaseSchema } from "../schema";
 
 export const ViewsListSchema = BaseSchema.extend({
   body: z.object({

server/types.ts

@@ -8,7 +8,7 @@ import {
   Client,
   CollectionPermission,
 } from "@shared/types";
-import BaseSchema from "@server/routes/api/BaseSchema";
+import { BaseSchema } from "@server/routes/api/schema";
 import { AccountProvisionerResult } from "./commands/accountProvisioner";
 import { FileOperation, Team, User } from "./models";