From 392d851353258b75549eb6277910fae695ecae9d Mon Sep 17 00:00:00 2001
From: Ryan Wang <i@ryanc.cc>
Date: Tue, 10 Jun 2025 00:22:34 +0800
Subject: [PATCH] feat: improve permission control for comment management
 (#7521)

#### What type of PR is this?

/area ui
/kind improvement
/milestone 2.21.x

#### What this PR does / why we need it:

Improve permission control for comment management.

#### Does this PR introduce a user-facing change?

```release-note
None
```
---
 .../components/CommentDetailModal.vue         | 47 ++++++++++---------
 .../comments/components/CommentListItem.vue   | 29 +++++++-----
 .../comments/components/ReplyListItem.vue     | 19 ++++----
 .../modules/dashboard/widgets/index.ts        |  1 +
 .../widgets/presets/comments/CommentItem.vue  | 31 ++++++------
 5 files changed, 72 insertions(+), 55 deletions(-)

diff --git a/ui/console-src/modules/contents/comments/components/CommentDetailModal.vue b/ui/console-src/modules/contents/comments/components/CommentDetailModal.vue
index 67031b61a..ad5743fef 100644
--- a/ui/console-src/modules/contents/comments/components/CommentDetailModal.vue
+++ b/ui/console-src/modules/contents/comments/components/CommentDetailModal.vue
@@ -1,4 +1,5 @@
 <script setup lang="ts">
+import HasPermission from "@/components/permission/HasPermission.vue";
 import { formatDatetime, relativeTimeTo } from "@/utils/date";
 import {
   consoleApiClient,
@@ -168,31 +169,35 @@ const websiteOfAnonymous = computed(() => {
             comment.comment.spec.content
           }}</pre>
         </VDescriptionItem>
-        <VDescriptionItem
-          v-if="!comment.comment.spec.approved"
-          :label="$t('core.comment.detail_modal.fields.new_reply')"
-        >
-          <ReplyFormItems
-            :required="false"
-            :auto-focus="false"
-            @update="newReply = $event"
-          />
-        </VDescriptionItem>
+        <HasPermission :permissions="['system:comments:manage']">
+          <VDescriptionItem
+            v-if="!comment.comment.spec.approved"
+            :label="$t('core.comment.detail_modal.fields.new_reply')"
+          >
+            <ReplyFormItems
+              :required="false"
+              :auto-focus="false"
+              @update="newReply = $event"
+            />
+          </VDescriptionItem>
+        </HasPermission>
       </VDescription>
     </div>
     <template #footer>
       <VSpace>
-        <VButton
-          v-if="!comment.comment.spec.approved"
-          type="secondary"
-          @click="handleApprove"
-        >
-          {{
-            newReply
-              ? $t("core.comment.operations.reply_and_approve.button")
-              : $t("core.comment.operations.approve.button")
-          }}
-        </VButton>
+        <HasPermission :permissions="['system:comments:manage']">
+          <VButton
+            v-if="!comment.comment.spec.approved"
+            type="secondary"
+            @click="handleApprove"
+          >
+            {{
+              newReply
+                ? $t("core.comment.operations.reply_and_approve.button")
+                : $t("core.comment.operations.approve.button")
+            }}
+          </VButton>
+        </HasPermission>
         <VButton @click="modal?.close()">
           {{ $t("core.common.buttons.close") }}
         </VButton>
diff --git a/ui/console-src/modules/contents/comments/components/CommentListItem.vue b/ui/console-src/modules/contents/comments/components/CommentListItem.vue
index 02cdad0d0..6e2d1d942 100644
--- a/ui/console-src/modules/contents/comments/components/CommentListItem.vue
+++ b/ui/console-src/modules/contents/comments/components/CommentListItem.vue
@@ -1,5 +1,6 @@
 <script lang="ts" setup>
 import EntityDropdownItems from "@/components/entity/EntityDropdownItems.vue";
+import HasPermission from "@/components/permission/HasPermission.vue";
 import { formatDatetime, relativeTimeTo } from "@/utils/date";
 import { usePermission } from "@/utils/permission";
 import { useOperationItemExtensionPoint } from "@console/composables/use-operation-extension-points";
@@ -325,12 +326,14 @@ const { operationItems } = useOperationItemExtensionPoint<ListedComment>(
                 state="success"
                 animate
               />
-              <span
-                class="select-none cursor-pointer text-gray-700 hover:text-gray-900"
-                @click="replyModal = true"
-              >
-                {{ $t("core.comment.operations.reply.button") }}
-              </span>
+              <HasPermission :permissions="['system:comments:manage']">
+                <span
+                  class="select-none cursor-pointer text-gray-700 hover:text-gray-900"
+                  @click="replyModal = true"
+                >
+                  {{ $t("core.comment.operations.reply.button") }}
+                </span>
+              </HasPermission>
             </div>
           </div>
         </template>
@@ -380,12 +383,14 @@ const { operationItems } = useOperationItemExtensionPoint<ListedComment>(
                 <VButton @click="refetch()">
                   {{ $t("core.common.buttons.refresh") }}
                 </VButton>
-                <VButton type="secondary" @click="replyModal = true">
-                  <template #icon>
-                    <IconAddCircle />
-                  </template>
-                  {{ $t("core.comment.reply_empty.new") }}
-                </VButton>
+                <HasPermission :permissions="['system:comments:manage']">
+                  <VButton type="secondary" @click="replyModal = true">
+                    <template #icon>
+                      <IconAddCircle />
+                    </template>
+                    {{ $t("core.comment.reply_empty.new") }}
+                  </VButton>
+                </HasPermission>
               </VSpace>
             </template>
           </VEmpty>
diff --git a/ui/console-src/modules/contents/comments/components/ReplyListItem.vue b/ui/console-src/modules/contents/comments/components/ReplyListItem.vue
index 9a56c2a8f..a541b11aa 100644
--- a/ui/console-src/modules/contents/comments/components/ReplyListItem.vue
+++ b/ui/console-src/modules/contents/comments/components/ReplyListItem.vue
@@ -1,5 +1,6 @@
 <script lang="ts" setup>
 import EntityDropdownItems from "@/components/entity/EntityDropdownItems.vue";
+import HasPermission from "@/components/permission/HasPermission.vue";
 import { formatDatetime, relativeTimeTo } from "@/utils/date";
 import { usePermission } from "@/utils/permission";
 import { useOperationItemExtensionPoint } from "@console/composables/use-operation-extension-points";
@@ -238,14 +239,16 @@ const { operationItems } = useOperationItemExtensionPoint<ListedReply>(
                   <IconReplyLine />
                   <span>{{ quoteReply.owner.displayName }}</span>
                 </a><br v-if="quoteReply" />{{ reply?.reply.spec.content }}</pre>
-            <div class="flex items-center gap-3 text-xs">
-              <span
-                class="select-none cursor-pointer text-gray-700 hover:text-gray-900"
-                @click="replyModal = true"
-              >
-                {{ $t("core.comment.operations.reply.button") }}
-              </span>
-            </div>
+            <HasPermission :permissions="['system:comments:manage']">
+              <div class="flex items-center gap-3 text-xs">
+                <span
+                  class="select-none cursor-pointer text-gray-700 hover:text-gray-900"
+                  @click="replyModal = true"
+                >
+                  {{ $t("core.comment.operations.reply.button") }}
+                </span>
+              </div>
+            </HasPermission>
           </div>
         </template>
       </VEntityField>
diff --git a/ui/console-src/modules/dashboard/widgets/index.ts b/ui/console-src/modules/dashboard/widgets/index.ts
index 4ed2c615e..f6f83d80f 100644
--- a/ui/console-src/modules/dashboard/widgets/index.ts
+++ b/ui/console-src/modules/dashboard/widgets/index.ts
@@ -108,6 +108,7 @@ export const internalWidgetDefinitions: DashboardWidgetDefinition[] = [
       minH: 6,
       minW: 3,
     },
+    permissions: ["system:comments:view"],
   },
   {
     id: "core:user:stats",
diff --git a/ui/console-src/modules/dashboard/widgets/presets/comments/CommentItem.vue b/ui/console-src/modules/dashboard/widgets/presets/comments/CommentItem.vue
index e3d30abe3..c67246764 100644
--- a/ui/console-src/modules/dashboard/widgets/presets/comments/CommentItem.vue
+++ b/ui/console-src/modules/dashboard/widgets/presets/comments/CommentItem.vue
@@ -1,4 +1,5 @@
 <script setup lang="ts">
+import HasPermission from "@/components/permission/HasPermission.vue";
 import { formatDatetime, relativeTimeTo } from "@/utils/date";
 import CommentDetailModal from "@console/modules/contents/comments/components/CommentDetailModal.vue";
 import OwnerButton from "@console/modules/contents/comments/components/OwnerButton.vue";
@@ -103,20 +104,22 @@ const handleDelete = async () => {
               class="whitespace-pre-wrap break-words text-sm text-gray-900 line-clamp-4"
               >{{ comment?.comment?.spec.content }}</pre
             >
-            <div class="flex items-center gap-3 text-xs">
-              <span
-                class="select-none cursor-pointer text-gray-700 hover:text-gray-900"
-                @click="detailModalVisible = true"
-              >
-                {{ $t("core.comment.operations.review.button") }}
-              </span>
-              <span
-                class="select-none cursor-pointer text-gray-700 hover:text-red-600"
-                @click="handleDelete"
-              >
-                {{ $t("core.common.buttons.delete") }}
-              </span>
-            </div>
+            <HasPermission :permissions="['system:comments:manage']">
+              <div class="flex items-center gap-3 text-xs">
+                <span
+                  class="select-none cursor-pointer text-gray-700 hover:text-gray-900"
+                  @click="detailModalVisible = true"
+                >
+                  {{ $t("core.comment.operations.review.button") }}
+                </span>
+                <span
+                  class="select-none cursor-pointer text-gray-700 hover:text-red-600"
+                  @click="handleDelete"
+                >
+                  {{ $t("core.common.buttons.delete") }}
+                </span>
+              </div>
+            </HasPermission>
           </div>
         </template>
       </VEntityField>