From e5afa2fb745f65bec7fa8262bb742281f97606b3 Mon Sep 17 00:00:00 2001
From: Umputun <umputun@gmail.com>
Date: Wed, 19 Dec 2018 01:39:45 -0600
Subject: [PATCH] add check for manual RO
 https://github.com/umputun/remark/issues/230#issuecomment-448492041

---
 backend/app/rest/api/admin_test.go   | 27 ++++++++++++++++++++++++++-
 backend/app/rest/api/rest_private.go |  7 ++++---
 2 files changed, 30 insertions(+), 4 deletions(-)

diff --git a/backend/app/rest/api/admin_test.go b/backend/app/rest/api/admin_test.go
index 9921a99d..5a45573d 100644
--- a/backend/app/rest/api/admin_test.go
+++ b/backend/app/rest/api/admin_test.go
@@ -1,6 +1,7 @@
 package api
 
 import (
+	"bytes"
 	"compress/gzip"
 	"encoding/json"
 	"fmt"
@@ -11,7 +12,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/dgrijalva/jwt-go"
+	jwt "github.com/dgrijalva/jwt-go"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
@@ -304,6 +305,18 @@ func TestAdmin_ReadOnly(t *testing.T) {
 	assert.Nil(t, err)
 	assert.True(t, info.ReadOnly)
 
+	// try to write comment
+	c := store.Comment{Text: "test test #2", ParentID: "p1",
+		Locator: store.Locator{SiteID: "radio-t", URL: "https://radio-t.com/blah"}}
+	b, err := json.Marshal(c)
+	assert.Nil(t, err, "can't marshal comment %+v", c)
+	req, err = http.NewRequest("POST", ts.URL+"/api/v1/comment", bytes.NewBuffer(b))
+	assert.Nil(t, err)
+	req.SetBasicAuth("dev", "password")
+	resp, err = client.Do(req)
+	assert.Nil(t, err)
+	assert.Equal(t, http.StatusForbidden, resp.StatusCode)
+
 	// reset post's read-only
 	req, err = http.NewRequest(http.MethodPut,
 		fmt.Sprintf("%s/api/v1/admin/readonly?site=radio-t&url=https://radio-t.com/blah&ro=0", ts.URL), nil)
@@ -315,6 +328,18 @@ func TestAdmin_ReadOnly(t *testing.T) {
 	info, err = srv.DataService.Info(store.Locator{SiteID: "radio-t", URL: "https://radio-t.com/blah"}, 0)
 	assert.Nil(t, err)
 	assert.False(t, info.ReadOnly)
+
+	// try to write comment
+	c = store.Comment{Text: "test test #2", ParentID: "p1",
+		Locator: store.Locator{SiteID: "radio-t", URL: "https://radio-t.com/blah"}}
+	b, err = json.Marshal(c)
+	assert.Nil(t, err, "can't marshal comment %+v", c)
+	req, err = http.NewRequest("POST", ts.URL+"/api/v1/comment", bytes.NewBuffer(b))
+	assert.Nil(t, err)
+	req.SetBasicAuth("dev", "password")
+	resp, err = client.Do(req)
+	assert.Nil(t, err)
+	assert.Equal(t, http.StatusCreated, resp.StatusCode)
 }
 
 func TestAdmin_ReadOnlyWithAge(t *testing.T) {
diff --git a/backend/app/rest/api/rest_private.go b/backend/app/rest/api/rest_private.go
index a1fe8bd9..0331c911 100644
--- a/backend/app/rest/api/rest_private.go
+++ b/backend/app/rest/api/rest_private.go
@@ -10,10 +10,10 @@ import (
 	"strings"
 	"time"
 
-	"github.com/dgrijalva/jwt-go"
+	jwt "github.com/dgrijalva/jwt-go"
 	"github.com/go-chi/chi"
 	"github.com/go-chi/render"
-	"github.com/hashicorp/go-multierror"
+	multierror "github.com/hashicorp/go-multierror"
 
 	"github.com/umputun/remark/backend/app/rest"
 	"github.com/umputun/remark/backend/app/rest/auth"
@@ -253,9 +253,10 @@ func (s *Rest) deleteMeCtrl(w http.ResponseWriter, r *http.Request) {
 
 func (s *Rest) isReadOnly(locator store.Locator) bool {
 	if s.ReadOnlyAge > 0 {
+		// check RO by age
 		if info, e := s.DataService.Info(locator, s.ReadOnlyAge); e == nil && info.ReadOnly {
 			return true
 		}
 	}
-	return false
+	return s.DataService.IsReadOnly(locator) // ro manually
 }