Comment fix

- Workspace administrators will not be able to delete or edit comments within private collections for which they do not have permissions.
- Users will not be able to delete or modify their comments if they have been removed from a private collection.

server/routes/api/comments/comments.ts

@@ -94,6 +94,10 @@ router.post(
         of: Comment,
       },
     });
+    const document = await Document.findByPk(comment.documentId, {
+      userId: user.id
+    });
+    authorize(user, "comment", document);
     authorize(user, "update", comment);
 
     await commentUpdater({
@@ -124,6 +128,10 @@ router.post(
     const comment = await Comment.findByPk(id, {
       transaction,
     });
+    const document = await Document.findByPk(comment.documentId, {
+      userId: user.id
+    });
+    authorize(user, "comment", document);
     authorize(user, "delete", comment);
 
     await commentDestroyer({