From 91ee3e62f2a5d25464ae3a60774fc2d8e51dd519 Mon Sep 17 00:00:00 2001
From: Tom Moor <tom.moor@gmail.com>
Date: Sat, 30 Jan 2021 18:31:08 -0800
Subject: [PATCH] fix: Reassign user on unpublish (#1857)

* findOne -> findByPk
---
 server/api/documents.js      |  6 +++---
 server/api/documents.test.js | 26 ++++++++++++++++++++++++--
 server/models/Document.js    | 10 ++++++++--
 server/models/Team.js        |  2 +-
 server/test/support.js       |  2 +-
 5 files changed, 37 insertions(+), 9 deletions(-)

diff --git a/server/api/documents.js b/server/api/documents.js
index 69b1950e0..1916c138e 100644
--- a/server/api/documents.js
+++ b/server/api/documents.js
@@ -942,7 +942,7 @@ router.post("documents.update", auth(), async (ctx) => {
     transaction = await sequelize.transaction();
 
     if (publish) {
-      await document.publish({ transaction });
+      await document.publish(user.id, { transaction });
     } else {
       await document.save({ autosave, transaction });
     }
@@ -1119,7 +1119,7 @@ router.post("documents.unpublish", auth(), async (ctx) => {
 
   authorize(user, "unpublish", document);
 
-  await document.unpublish();
+  await document.unpublish(user.id);
 
   await Event.create({
     name: "documents.unpublish",
@@ -1213,7 +1213,7 @@ export async function createDocumentFromContext(ctx: any) {
   });
 
   if (publish) {
-    await document.publish();
+    await document.publish(user.id);
 
     await Event.create({
       name: "documents.publish",
diff --git a/server/api/documents.test.js b/server/api/documents.test.js
index 397487a80..76c7c4062 100644
--- a/server/api/documents.test.js
+++ b/server/api/documents.test.js
@@ -1962,7 +1962,7 @@ describe("#documents.delete", () => {
 
 describe("#documents.unpublish", () => {
   it("should unpublish a document", async () => {
-    const { user, document } = await seed();
+    let { user, document } = await seed();
     const res = await server.post("/api/documents.unpublish", {
       body: { token: user.getJwtToken(), id: document.id },
     });
@@ -1971,6 +1971,28 @@ describe("#documents.unpublish", () => {
     expect(res.status).toEqual(200);
     expect(body.data.id).toEqual(document.id);
     expect(body.data.publishedAt).toBeNull();
+
+    document = await Document.unscoped().findByPk(document.id);
+    expect(document.userId).toEqual(user.id);
+  });
+
+  it("should unpublish another users document", async () => {
+    const { user, collection } = await seed();
+    let document = await buildDocument({
+      teamId: user.teamId,
+      collectionId: collection.id,
+    });
+    const res = await server.post("/api/documents.unpublish", {
+      body: { token: user.getJwtToken(), id: document.id },
+    });
+    const body = await res.json();
+
+    expect(res.status).toEqual(200);
+    expect(body.data.id).toEqual(document.id);
+    expect(body.data.publishedAt).toBeNull();
+
+    document = await Document.unscoped().findByPk(document.id);
+    expect(document.userId).toEqual(user.id);
   });
 
   it("should fail to unpublish a draft document", async () => {
@@ -1996,7 +2018,7 @@ describe("#documents.unpublish", () => {
     expect(res.status).toEqual(403);
   });
 
-  it("should fail to unpublish a archived document", async () => {
+  it("should fail to unpublish an archived document", async () => {
     const { user, document } = await seed();
     await document.archive();
 
diff --git a/server/models/Document.js b/server/models/Document.js
index 80014b402..bc31eca0d 100644
--- a/server/models/Document.js
+++ b/server/models/Document.js
@@ -575,24 +575,30 @@ Document.prototype.archiveWithChildren = async function (userId, options) {
   return this.save(options);
 };
 
-Document.prototype.publish = async function (options) {
+Document.prototype.publish = async function (userId: string, options) {
   if (this.publishedAt) return this.save(options);
 
   const collection = await Collection.findByPk(this.collectionId);
   await collection.addDocumentToStructure(this, 0);
 
+  this.lastModifiedById = userId;
   this.publishedAt = new Date();
   await this.save(options);
 
   return this;
 };
 
-Document.prototype.unpublish = async function (options) {
+Document.prototype.unpublish = async function (userId: string, options) {
   if (!this.publishedAt) return this;
 
   const collection = await this.getCollection();
   await collection.removeDocumentInStructure(this);
 
+  // unpublishing a document converts the "ownership" to yourself, so that it
+  // can appear in your drafts rather than the original creators
+  this.userId = userId;
+
+  this.lastModifiedById = userId;
   this.publishedAt = null;
   await this.save(options);
 
diff --git a/server/models/Team.js b/server/models/Team.js
index 4faf6d5c3..eb26c1217 100644
--- a/server/models/Team.js
+++ b/server/models/Team.js
@@ -181,7 +181,7 @@ Team.prototype.provisionFirstCollection = async function (userId) {
       title,
       text,
     });
-    await document.publish();
+    await document.publish(collection.createdById);
   }
 };
 
diff --git a/server/test/support.js b/server/test/support.js
index 4fd1125ca..2f3cb5706 100644
--- a/server/test/support.js
+++ b/server/test/support.js
@@ -74,7 +74,7 @@ const seed = async () => {
     title: "First ever document",
     text: "# Much test support",
   });
-  await document.publish();
+  await document.publish(collection.createdById);
   await collection.reload();
 
   return {