AO3-5860 Prevent leaving comments or kudos when logged in as admin

app/controllers/comments_controller.rb

@@ -30,6 +30,7 @@ class CommentsController < ApplicationController
   before_action :check_permission_to_moderate, only: [:approve, :reject]
   before_action :check_permission_to_modify_frozen_status, only: [:freeze, :unfreeze]
   before_action :check_permission_to_modify_hidden_status, only: [:hide, :unhide]
+  before_action :admin_logout_required, only: [:new, :create, :add_comment_reply]
 
   include BlockHelper
 

app/controllers/kudos_controller.rb

@@ -1,5 +1,6 @@
 class KudosController < ApplicationController
   skip_before_action :store_location
+  before_action :admin_logout_required, only: [:create]
 
   def index
     @work = Work.find(params[:work_id])

app/helpers/comments_helper.rb

@@ -108,6 +108,7 @@ def can_reply_to_comment?(comment)
     return false if comment_parent_hidden?(comment)
     return false if blocked_by_comment?(comment)
     return false if blocked_by?(comment.ultimate_parent)
+    return false if logged_in_as_admin?
 
     return true unless guest?
 

app/views/comments/_comment_form.html.erb

@@ -5,7 +5,7 @@
 <div class="post comment" id="comment_form_for_<%= commentable.id %>">
   <%= form_for value_for_comment_form(commentable, comment), remote: !comment.new_record?, authenticity_token: true, html: { id: "comment_for_#{commentable.id}" } do |f| %>
     <fieldset>
-      <legend><%= ts("Post Comment") %></legend>
+      <legend><%= t(".form_title") %></legend>
 
       <% # here come the hacks (hidden fields to transmit various info to the create action) %>
       <% if commentable.is_a?(Tag) %>
@@ -28,19 +28,19 @@
 
       <% if comments_are_moderated(commentable) && !current_user_is_work_creator(commentable) %>
         <p class="notice">
-          <%= ts("This work's creator has chosen to moderate comments on the work. Your comment will not appear until it has been approved by the creator.") %>
+          <%= t(".moderation_forewarning") %>
         </p>
       <% end %>
 
       <% if logged_in? %>
         <% if current_user_is_anonymous_creator(commentable) %>
           <p class="notice">
-           <%= ts("While this work is anonymous, comments you post will also be listed anonymously.") %>
+          <%= t(".anonymous_forewarning") %>
           </p>
         <% end %>
 
         <% if current_user.pseuds.count > 1 %>
-          <h4 class="heading"><%= ts("Comment as") %> <%= f.collection_select :pseud_id, current_user.pseuds, :id, :name, {:selected => (comment.pseud ? comment.pseud.id.to_s : current_user.default_pseud.id.to_s)}, :id => "comment_pseud_id_for_#{commentable.id}", :title => ts("Choose Name") %>
+          <h4 class="heading"><%= t(".comment_as") %> <%= f.collection_select :pseud_id, current_user.pseuds, :id, :name, { selected: (comment.pseud ? comment.pseud.id.to_s : current_user.default_pseud.id.to_s) }, id: "comment_pseud_id_for_#{commentable.id}", title: t(".choose_name") %>
             <% if controller.controller_name == "inbox" %>
               <% if commentable.by_anonymous_creator? %>
                 <span><%= ts("to") %> <%= "Anonymous Creator" %> <%= ts("on") %> <%= commentable_description_link(commentable) %></span>
@@ -51,8 +51,8 @@
             (<%= allowed_html_instructions %>)
           </h4>
         <% else %>
-          <h4 class="heading"><%= ts("Comment as") %> <span class="byline"><%= current_user.default_pseud.name %></span>
-            <%= f.hidden_field :pseud_id, :value => "#{current_user.default_pseud.id}", :id => "comment_pseud_id_for_#{commentable.id}" %>
+          <h4 class="heading"><%= t(".comment_as") %> <span class="byline"><%= current_user.default_pseud.name %></span>
+            <%= f.hidden_field :pseud_id, value: current_user.default_pseud.id.to_s, id: "comment_pseud_id_for_#{commentable.id}" %>
             <% if controller.controller_name == "inbox" %>
               <% if commentable.by_anonymous_creator? %>
                 <span><%= ts("to") %> <%= "Anonymous Creator" %> <%= ts("on") %> <%= commentable_description_link(commentable) %></span>
@@ -64,46 +64,39 @@
           <p class="footnote">(<%= allowed_html_instructions %>)</p>
         <% end %>
 
-      <% elsif logged_in_as_admin? %>
-        <h4 class="heading"><%= ts("Comment as") %> <span class="byline"><%= current_admin.login %></span>
-          <%= f.hidden_field :name, :value => "#{current_admin.login}", :id => "comment_name_for_#{commentable.id}" %>
-          <%= f.hidden_field :email, :value => "#{current_admin.email}", :id => "comment_email_for_#{commentable.id}" %>
-        </h4>
-        <p class="footnote">(<%= allowed_html_instructions %>)</p>
-
       <% else %>
         <dl>
-          <dt class="landmark"><%= ts("Note") %>:</dt>
-          <dd class="instructions comment_form"><%=ts("All fields are required. Your email address will not be published.") %></dd>
-          <dt><%= f.label "name_for_#{commentable.id}", ts("Guest name: ") %></dt>
+          <dt class="landmark"><%= t(".note") %>:</dt>
+          <dd class="instructions comment_form"><%= t(".guest_instructions") %></dd>
+          <dt><%= f.label "name_for_#{commentable.id}", t(".guest_name") %></dt>
           <dd>
-            <%= f.text_field :name, :id => "comment_name_for_#{commentable.id}" %>
-            <%= live_validation_for_field("comment_name_for_#{commentable.id}", :failureMessage => ts('Please enter your name.')) %>
+            <%= f.text_field :name, id: "comment_name_for_#{commentable.id}" %>
+            <%= live_validation_for_field("comment_name_for_#{commentable.id}", failureMessage: t(".guest_name_failure")) %>
           </dd>
-          <dt><%= f.label "email_for_#{commentable.id}", ts("Guest email: ") %></dt>
+          <dt><%= f.label "email_for_#{commentable.id}", t(".guest_email") %></dt>
           <dd>
-            <%= f.text_field :email, :id => "comment_email_for_#{commentable.id}" %>
-            <%= live_validation_for_field("comment_email_for_#{commentable.id}", :failureMessage => ts('Please enter your email address.')) %>
+            <%= f.text_field :email, id: "comment_email_for_#{commentable.id}" %>
+            <%= live_validation_for_field("comment_email_for_#{commentable.id}", failureMessage: t(".guest_email_failure")) %>
           </dd>
         </dl>
         <p class="footnote">(<%= allowed_html_instructions %>)</p>
       <% end %>
 
       <p>
         <% content_id = "comment_content_for_#{commentable.id}" %>
-        <label for="<%= content_id %>" class="landmark"><%= ts("Comment") %></label>
-        <%= f.text_area :comment_content, :id => content_id, :class => "comment_form observe_textlength", :title => ts("Enter Comment") %>
+        <label for="<%= content_id %>" class="landmark"><%= t(".comment_action") %></label>
+        <%= f.text_area :comment_content, id: content_id, class: "comment_form observe_textlength", title: t(".comment_field_title") %>
         <input type="hidden" id="controller_name_for_<%= commentable.id %>" name="controller_name" value="<%= @controller_name ||= controller.controller_name %>" />
       </p>
       <%= generate_countdown_html("comment_content_for_#{commentable.id}", ArchiveConfig.COMMENT_MAX) %>
-      <%= live_validation_for_field("comment_content_for_#{commentable.id}",
-              :failureMessage => ts('Brevity is the soul of wit, but we need your comment to have text in it.'),
-              :maximum_length => ArchiveConfig.COMMENT_MAX,
-              :tooLongMessage => ts("must be less than %{count} characters long.", :count => ArchiveConfig.COMMENT_MAX)) %>
-      <p class="submit actions">
-        <%= f.submit button_name, :id => "comment_submit_for_#{commentable.id}", data: {disable_with: ts("Please wait...")} %>
+      <%= live_validation_for_field "comment_content_for_#{commentable.id}",
+            failureMessage: t(".comment_too_short"),
+            maximum_length: ArchiveConfig.COMMENT_MAX,
+            tooLongMessage: t(".comment_too_long", count: ArchiveConfig.COMMENT_MAX) %>
+    <p class="submit actions">
+        <%= f.submit button_name, id: "comment_submit_for_#{commentable.id}", data: { disable_with: t(".processing_message") } %>
         <% if controller.controller_name == 'inbox' %>
-          <a name="comment_cancel" id="comment_cancel"><%= ts("Cancel") %></a>
+          <a name="comment_cancel" id="comment_cancel"><%= t(".cancel_action") %></a>
         <% elsif comment.persisted? %>
           <%= cancel_edit_comment_link(comment) %>
         <% elsif commentable.is_a?(Comment) || commentable.is_a?(CommentDecorator) %>

app/views/comments/_commentable.html.erb

@@ -28,7 +28,7 @@
       <li><%= link_to ts('Back to AO3 News Index'), admin_posts_path %></li>
     <% end %>
 
-    <% if @work && !is_author_of?(@work) && !blocked_by?(@work) %>
+    <% if @work && !is_author_of?(@work) && !blocked_by?(@work) && !logged_in_as_admin? %>
       <li>
         <%= form_for(:kudo, url: kudos_path, html: { method: 'post', id: 'new_kudo' }) do |kudo_form| %>
           <%= kudo_form.hidden_field :commentable_id, :value => @work.id %>
@@ -113,6 +113,10 @@
     <p class="notice">
       <%= t(".blocked") %>
     </p>
+  <% elsif logged_in_as_admin? %>
+    <p class="notice">
+      <%= t(".logged_as_admin") %>
+    </p>
   <% else %>
     <div id="add_comment_placeholder" title="top level comment">
       <div id="add_comment">

config/locales/views/en.yml

@@ -319,7 +319,7 @@ en:
   admins:
     index:
       confidentiality_reminder: You are now logged in as an admin. That means you will probably encounter information that is personal or confidential (e.g. usernames, email and IP addresses, creator names on anonymous works, etc). Please do not use this information in ways unrelated to your OTW role. If you have questions about what you can or cannot do with information you see here, contact your committee chair(s).
-      log_out_reminder: Please remember to log out before resuming your normal site activity and leaving comments and kudos!
+      log_out_reminder: Please remember to log out before resuming your normal site activity!
       page_title: Hi, %{login}!
       responsibility: With great power comes great responsibility.
       roles:
@@ -414,13 +414,32 @@ en:
           unreviewed_by_collection: Works and bookmarks listed here have been added to a collection but need approval from a collection moderator before they are listed in the collection.
         page_heading: Items by %{username} in Collections
   comments:
+    comment_form:
+      anonymous_forewarning: While this work is anonymous, comments you post will also be listed anonymously.
+      cancel_action: Cancel
+      choose_name: Choose Name
+      comment_action: Comment
+      comment_as: Comment as
+      comment_field_title: Enter Comment
+      comment_too_long: must be less than %{count} characters long.
+      comment_too_short: Brevity is the soul of wit, but we need your comment to have text in it.
+      form_title: Post Comment
+      guest_email: 'Guest email:'
+      guest_email_failure: Please enter your email address.
+      guest_instructions: All fields are required. Your email address will not be published.
+      guest_name: 'Guest name:'
+      guest_name_failure: Please enter your name.
+      moderation_forewarning: This work's creator has chosen to moderate comments on the work. Your comment will not appear until it has been approved by the creator.
+      note: Note
+      processing_message: Please wait...
     commentable:
       actions:
         comment: Comment
       add_to_collections_link: Add to Collections
       blocked: Sorry, you have been blocked by one or more of this work's creators.
       guest_comments_disabled: Sorry, the Archive doesn't allow guests to comment right now.
       invite_to_collections_link: Invite To Collections
+      logged_as_admin: Please log out of your admin account to comment.
       permissions:
         admin_post:
           alt_action: You can however %{support_link} with any feedback or questions.

features/admins/admin_settings.feature

@@ -138,11 +138,6 @@ Feature: Admin Settings Page
   Scenario: Tag comments are not affected when guest comments are turned off
     Given guest comments are off
       And a fandom exists with name: "Stargate SG-1", canonical: true
-    When I am logged in as a super admin
-      And I view the tag "Stargate SG-1" with comments
-    Then I should not see "Sorry, the Archive doesn't allow guests to comment right now."
-    When I post the comment "Important policy decision" on the tag "Stargate SG-1"
-    Then I should see "Comment created!"
     When I am logged in as a tag wrangler
       And I view the tag "Stargate SG-1" with comments
     Then I should not see "Sorry, the Archive doesn't allow guests to comment right now."

features/comments_and_kudos/add_comment.feature

@@ -235,3 +235,30 @@ Scenario: Users with different time zone preferences should see the time in thei
     And I view the work "Generic Work" with comments
   Then I should see "AEST" within ".posted.datetime"
     And I should see "AEST" within ".edited.datetime"
+
+Scenario: Cannot comment (no form) while logged as admin
+
+    Given the work "Generic Work"
+      And I am logged in as an admin
+      And I view the work "Generic Work"
+    Then I should see "Generic Work"
+      And I should not see "Post Comment"
+      And I should not see a "Comment" button
+      And I should see "Please log out of your admin account to comment."
+
+Scenario: Cannot reply to comments (no button) while logged as admin
+
+    Given the work "Generic Work"
+    When I am logged in as "commenter"
+      And I view the work "Generic Work"
+      And I post a comment "Woohoo"
+    When I am logged in as an admin
+      And I view the work "Generic Work"
+      And I follow "Comments (1)"
+    Then I should see "Woohoo"
+      And I should not see "Reply"
+    When I am logged out
+      And I view the work "Generic Work"
+      And I follow "Comments (1)"
+    Then I should see "Woohoo"
+      And I should see "Reply"

features/comments_and_kudos/kudos.feature

@@ -195,3 +195,9 @@ Feature: Kudos
       And the kudos cache has expired
       And I view the work "Interesting beans"
     Then I should not see "newusername1 left kudos on this work!"
+
+  Scenario: Cannot leave kudos (no button) while logged as admin
+    Given I am logged in as an admin
+      And I view the work "Awesome Story"
+    Then I should see "Awesome Story"
+      And I should not see a "Kudos ♥" button

features/tags_and_wrangling/tag_comment.feature

@@ -43,24 +43,17 @@ I'd like to comment on a tag'
   Scenario: Multiple comments on a tag increment correctly
 
     Given the following activated tag wranglers exist
-        | login     |
-        | dizmo     |
+        | login        |
+        | dizmo        |
+        | someone_else |
       And a fandom exists with name: "Stargate Atlantis", canonical: true
     When I am logged in as "dizmo"
     When I post the comment "Yep, we should have a Stargate franchise metatag." on the tag "Stargate Atlantis"
-    When I am logged in as an admin
+    When I am logged in as "someone_else"
     When I post the comment "Important policy decision" on the tag "Stargate Atlantis"
     When I view the tag "Stargate Atlantis"
     Then I should see "2 comments"
 
-    Scenario: admin can also comment on tags, issue 1428
-
-    Given a fandom exists with name: "Stargate Atlantis", canonical: true
-    When I am logged in as an admin
-    When I post the comment "Important policy decision" on the tag "Stargate Atlantis" via web
-    When I view the tag "Stargate Atlantis"
-    Then I should see "1 comment"
-
   Scenario: Issue 2185: email notifications for tag commenting; TO DO: replies to comments
 
     Given the following activated tag wranglers exist

spec/controllers/comments_controller_spec.rb

@@ -166,6 +166,15 @@
           it_redirects_to_with_error(work_path(work), "Sorry, this work doesn't allow comments.")
         end
       end
+
+      context "when logged in as an admin" do
+        before { fake_login_admin(create(:admin)) }
+
+        it "redirects to root with notice prompting log out" do
+          get :add_comment_reply, params: { comment_id: comment.id }
+          it_redirects_to_with_notice(root_path, "Please log out of your admin account first!")
+        end
+      end
     end
 
     shared_examples "guest cannot reply to a user with guest replies disabled" do
@@ -300,10 +309,9 @@
       context "when logged in as an admin" do
         before { fake_login_admin(create(:admin)) }
 
-        it "renders the :new template" do
+        it "redirects to root with notice prompting log out" do
           get :new, params: { tag_id: fandom.name }
-          expect(response).to render_template("new")
-          expect(assigns(:name)).to eq("Fandom")
+          it_redirects_to_with_notice(root_path, "Please log out of your admin account first!")
         end
       end
 
@@ -531,16 +539,11 @@
       context "when logged in as an admin" do
         before { fake_login_admin(create(:admin)) }
 
-        it "posts the comment and shows it in context" do
+        it "redirects to root with notice prompting log out" do
           post :create, params: { tag_id: fandom.name, comment: anon_comment_attributes }
+          it_redirects_to_with_notice(root_path, "Please log out of your admin account first!")
           comment = Comment.last
-          expect(comment.commentable).to eq fandom
-          expect(comment.name).to eq anon_comment_attributes[:name]
-          expect(comment.email).to eq anon_comment_attributes[:email]
-          expect(comment.comment_content).to include anon_comment_attributes[:comment_content]
-          path = comments_path(tag_id: fandom.to_param,
-                               anchor: "comment_#{comment.id}")
-          expect(response).to redirect_to path
+          expect(comment).to eq nil
         end
       end
 
@@ -624,6 +627,17 @@
           expect(cookies[:flash_is_set]).to eq(1)
         end
       end
+
+      context "when logged in as an admin" do
+        let(:work) { create(:work) }
+
+        before { fake_login_admin(create(:admin)) }
+
+        it "redirects to root with notice prompting log out" do
+          post :create, params: { work_id: work.id, comment: anon_comment_attributes }
+          it_redirects_to_with_notice(root_path, "Please log out of your admin account first!")
+        end
+      end
     end
 
     context "when the commentable is an admin post" do

spec/controllers/kudos_controller_spec.rb

@@ -208,5 +208,25 @@
         end
       end
     end
+
+    context "when kudos giver is admin" do
+      let(:work) { create(:work) }
+      let(:admin) { create(:admin) }
+
+      before { fake_login_admin(admin) }
+
+      it "redirects to root with notice prompting log out" do
+        post :create, params: { kudo: { commentable_id: work.id, commentable_type: "Work" } }
+        it_redirects_to_with_notice(root_path, "Please log out of your admin account first!")
+        expect(assigns(:kudo)).to be_nil
+      end
+
+      context "with format: :js" do
+        it "does not create any kudo" do
+          post :create, params: { kudo: { commentable_id: work.id, commentable_type: "Work" }, format: :js }
+          expect(assigns(:kudo)).to be_nil
+        end
+      end
+    end
   end
 end