From 65556c04440ab65e15be213e936ef7288977d8b6 Mon Sep 17 00:00:00 2001
From: Blade Barringer <blade@crookedneighbor.com>
Date: Wed, 24 Aug 2016 21:32:32 -0500
Subject: [PATCH] feat: Allow admins to flag messages in private groups

---
 .../integration/chat/POST-chat.flag.test.js   | 37 ++++++++++++++++++-
 website/server/controllers/api-v3/chat.js     |  6 ++-
 2 files changed, 41 insertions(+), 2 deletions(-)

diff --git a/test/api/v3/integration/chat/POST-chat.flag.test.js b/test/api/v3/integration/chat/POST-chat.flag.test.js
index 187a86614b..9c2d5849a9 100644
--- a/test/api/v3/integration/chat/POST-chat.flag.test.js
+++ b/test/api/v3/integration/chat/POST-chat.flag.test.js
@@ -8,7 +8,7 @@ describe('POST /chat/:chatId/flag', () => {
   let user, admin, anotherUser, group;
   const TEST_MESSAGE = 'Test Message';
 
-  before(async () => {
+  beforeEach(async () => {
     user = await generateUser({balance: 1});
     admin = await generateUser({balance: 1, 'contributor.admin': true});
     anotherUser = await generateUser();
@@ -83,6 +83,41 @@ describe('POST /chat/:chatId/flag', () => {
     expect(messageToCheck.flagCount).to.equal(5);
   });
 
+  it('allows admin to flag a message in a private group', async () => {
+    let privateGroup = await user.post('/groups', {
+      name: 'Test party',
+      type: 'party',
+      privacy: 'private',
+    });
+    let { message } = await user.post(`/groups/${privateGroup._id}/chat`, {message: TEST_MESSAGE});
+
+    let flagResult = await admin.post(`/groups/${privateGroup._id}/chat/${message.id}/flag`);
+
+    expect(flagResult.flags[admin._id]).to.equal(true);
+    expect(flagResult.flagCount).to.equal(5);
+
+    let groupWithFlags = await user.get(`/groups/${privateGroup._id}`);
+    let messageToCheck = find(groupWithFlags.chat, {id: message.id});
+
+    expect(messageToCheck).to.not.exist;
+  });
+
+  it('does not allow non member to flag message in private group', async () => {
+    let privateGroup = await user.post('/groups', {
+      name: 'Test party',
+      type: 'party',
+      privacy: 'private',
+    });
+    let { message } = await user.post(`/groups/${privateGroup._id}/chat`, {message: TEST_MESSAGE});
+
+    await expect(anotherUser.post(`/groups/${privateGroup._id}/chat/${message.id}/flag`))
+      .to.eventually.be.rejected.and.eql({
+        code: 404,
+        error: 'NotFound',
+        message: t('groupNotFound'),
+      });
+  });
+
   it('Returns an error when user tries to flag a message that is already flagged', async () => {
     let { message } = await anotherUser.post(`/groups/${group._id}/chat`, {message: TEST_MESSAGE});
 
diff --git a/website/server/controllers/api-v3/chat.js b/website/server/controllers/api-v3/chat.js
index 51838994bf..e6c693b701 100644
--- a/website/server/controllers/api-v3/chat.js
+++ b/website/server/controllers/api-v3/chat.js
@@ -182,7 +182,11 @@ api.flagChat = {
     let validationErrors = req.validationErrors();
     if (validationErrors) throw validationErrors;
 
-    let group = await Group.getGroup({user, groupId});
+    let group = await Group.getGroup({
+      user,
+      groupId,
+      optionalMembership: user.contributor.admin,
+    });
     if (!group) throw new NotFound(res.t('groupNotFound'));
     let message = _.find(group.chat, {id: req.params.chatId});