discourse/app/jobs/regular/delete_replies.rb
Régis Hanol bd94fcbce6
FIX: DeleteReplies should use the guardian instead of checking for staff (#35443)
Category moderators (who aren't staff member) are able to a topic timer
to automatically delete replies after a certain amount of time but the
background job (DeleteReplies) was deleting the "topic timer" because
the category moderators wasn't a staff member.

There was a discrepency between the UX who used "can_delete" to
show/hide the "topic timer" option and the back-end who was checking for
"staff" membership.

This fixes it by changing the backend to use the guardian's "can_delete"
method instead.

Internal ref - t/165077
2025-10-16 18:26:41 +02:00

33 lines
980 B
Ruby
Vendored

# frozen_string_literal: true
module Jobs
class DeleteReplies < ::Jobs::TopicTimerBase
def execute_timer_action(topic_timer, topic)
unless Guardian.new(topic_timer.user).can_delete?(topic)
topic_timer.trash!(Discourse.system_user)
return
end
replies = topic.posts.where("posts.post_number > 1")
replies =
replies.where(
"like_count < ?",
SiteSetting.skip_auto_delete_reply_likes,
) if SiteSetting.skip_auto_delete_reply_likes > 0
replies
.where("posts.created_at < ?", topic_timer.duration_minutes.minutes.ago)
.each do |post|
PostDestroyer.new(
topic_timer.user,
post,
context: I18n.t("topic_statuses.auto_deleted_by_timer"),
).destroy
end
topic_timer.execute_at =
(replies.minimum(:created_at) || Time.zone.now) + topic_timer.duration_minutes.minutes
topic_timer.save
end
end
end