Added in-reply-to support to comments API

ref https://linear.app/tryghost/issue/PLG-230

- adds `in_reply_to_id` to API output
- adds `in_reply_to_snippet` to API output
  - dynamically generated from the HTML of the replied-to comment
  - excluded if the replied-to comment has been deleted or hidden
- allows setting `in_reply_to_id` when creating comments
  - id must reference a reply with the same parent
  - id must reference a published comment
- adds email notification for the original reply author when their comment is replied to

ghost/core/core/server/api/endpoints/comments-members.js

@@ -109,7 +109,6 @@ const controller = {
         },
         options: [
             'include'
-
         ],
         validation: {
             options: {

ghost/core/core/server/api/endpoints/utils/serializers/output/mappers/comments.js

@@ -1,9 +1,12 @@
 const _ = require('lodash');
 const utils = require('../../..');
 const url = require('../utils/url');
+const htmlToPlaintext = require('@tryghost/html-to-plaintext');
 
 const commentFields = [
     'id',
+    'in_reply_to_id',
+    'in_reply_to_snippet',
     'status',
     'html',
     'created_at',
@@ -42,6 +45,10 @@ const countFields = [
 const commentMapper = (model, frame) => {
     const jsonModel = model.toJSON ? model.toJSON(frame.options) : model;
 
+    if (jsonModel.inReplyTo && jsonModel.inReplyTo.status === 'published') {
+        jsonModel.in_reply_to_snippet = htmlToPlaintext.comment(jsonModel.inReplyTo.html);
+    }
+
     const response = _.pick(jsonModel, commentFields);
 
     if (jsonModel.member) {
@@ -77,7 +84,7 @@ const commentMapper = (model, frame) => {
             response.html = null;
         }
     }
-    
+
     return response;
 };
 

ghost/core/core/server/models/comment.js

@@ -46,6 +46,10 @@ const Comment = ghostBookshelf.Model.extend({
         return this.belongsTo('Comment', 'parent_id');
     },
 
+    inReplyTo() {
+        return this.belongsTo('Comment', 'in_reply_to_id');
+    },
+
     likes() {
         return this.hasMany('CommentLike', 'comment_id');
     },
@@ -175,25 +179,26 @@ const Comment = ghostBookshelf.Model.extend({
     /**
      * We have to ensure consistency. If you listen on model events (e.g. `member.added`), you can expect that you always
      * receive all fields including relations. Otherwise you can't rely on a consistent flow. And we want to avoid
-     * that event listeners have to re-fetch a resource. This function is used in the context of inserting
-     * and updating resources. We won't return the relations by default for now.
+     * that event listeners have to re-fetch a resource.
      */
     defaultRelations: function defaultRelations(methodName, options) {
-        // @todo: the default relations are not working for 'add' when we add it below
+        // @TODO: the default relations are not working for 'add' when we add it below
+        // this is because bookshelf does not automatically call `fetch` after adding so
+        // our bookshelf eager-load plugin doesn't use the `withRelated` options
         if (['findAll', 'findPage', 'edit', 'findOne', 'destroy'].indexOf(methodName) !== -1) {
             if (!options.withRelated || options.withRelated.length === 0) {
                 if (options.parentId) {
                     // Do not include replies for replies
                     options.withRelated = [
                         // Relations
-                        'member', 'count.likes', 'count.liked'
+                        'inReplyTo', 'member', 'count.likes', 'count.liked'
                     ];
                 } else {
                     options.withRelated = [
                         // Relations
-                        'member', 'count.replies', 'count.likes', 'count.liked',
+                        'member', 'inReplyTo', 'count.replies', 'count.likes', 'count.liked',
                         // Replies (limited to 3)
-                        'replies', 'replies.member' , 'replies.count.likes', 'replies.count.liked'
+                        'replies', 'replies.member', 'replies.inReplyTo', 'replies.count.likes', 'replies.count.liked'
                     ];
                 }
             }

ghost/core/core/server/services/comments/CommentsController.js

@@ -114,6 +114,7 @@ module.exports = class CommentsController {
         if (data.parent_id) {
             result = await this.service.replyToComment(
                 data.parent_id,
+                data.in_reply_to_id,
                 frame.options.context.member.id,
                 data.html,
                 frame.options

ghost/core/core/server/services/comments/CommentsService.js

@@ -83,7 +83,10 @@ class CommentsService {
         await this.emails.notifyPostAuthors(comment);
 
         if (comment.get('parent_id')) {
-            await this.emails.notifyParentCommentAuthor(comment);
+            await this.emails.notifyParentCommentAuthor(comment, {type: 'parent'});
+        }
+        if (comment.get('in_reply_to_id')) {
+            await this.emails.notifyParentCommentAuthor(comment, {type: 'in_reply_to'});
         }
     }
 
@@ -253,11 +256,12 @@ class CommentsService {
 
     /**
      * @param {string} parent - The ID of the Comment to reply to
+     * @param {string} inReplyTo - The ID of the Reply to reply to
      * @param {string} member - The ID of the Member to comment as
      * @param {string} comment - The HTML content of the Comment
      * @param {any} options
      */
-    async replyToComment(parent, member, comment, options) {
+    async replyToComment(parent, inReplyTo, member, comment, options) {
         this.checkEnabled();
         const memberModel = await this.models.Member.findOne({
             id: member
@@ -281,6 +285,7 @@ class CommentsService {
                 message: tpl(messages.replyToReply)
             });
         }
+
         const postModel = await this.models.Post.findOne({
             id: parentComment.get('post_id')
         }, {
@@ -291,10 +296,27 @@ class CommentsService {
 
         this.checkPostAccess(postModel, memberModel);
 
+        let inReplyToComment;
+        if (parent && inReplyTo) {
+            inReplyToComment = await this.getCommentByID(inReplyTo, options);
+
+            // we only allow references to published comments to avoid leaking
+            // hidden data via the snippet included in API responses
+            if (inReplyToComment && inReplyToComment.get('status') !== 'published') {
+                inReplyToComment = null;
+            }
+
+            // we don't allow in_reply_to references across different parents
+            if (inReplyToComment && inReplyToComment.get('parent_id') !== parent) {
+                inReplyToComment = null;
+            }
+        }
+
         const model = await this.models.Comment.add({
             post_id: parentComment.get('post_id'),
             member_id: member,
             parent_id: parentComment.id,
+            in_reply_to_id: inReplyToComment && inReplyToComment.get('id'),
             html: comment,
             status: 'published'
         }, options);

ghost/core/core/server/services/comments/CommentsServiceEmails.js

@@ -60,8 +60,13 @@ class CommentsServiceEmails {
         }
     }
 
-    async notifyParentCommentAuthor(reply) {
-        const parent = await this.models.Comment.findOne({id: reply.get('parent_id')});
+    async notifyParentCommentAuthor(reply, {type = 'parent'} = {}) {
+        let parent;
+        if (type === 'in_reply_to') {
+            parent = await this.models.Comment.findOne({id: reply.get('in_reply_to_id')});
+        } else {
+            parent = await this.models.Comment.findOne({id: reply.get('parent_id')});
+        }
         const parentMember = parent.related('member');
 
         if (parent?.get('status') !== 'published' || !parentMember.get('enable_comment_notifications')) {

ghost/core/test/e2e-api/admin/__snapshots__/activity-feed.test.js.snap

@@ -22699,7 +22699,7 @@ exports[`Activity Feed API Can filter events by post id 2: [headers] 1`] = `
 Object {
   "access-control-allow-origin": "http://127.0.0.1:2369",
   "cache-control": "no-cache, private, no-store, must-revalidate, max-stale=0, post-check=0, pre-check=0",
-  "content-length": "17559",
+  "content-length": "17625",
   "content-type": "application/json; charset=utf-8",
   "content-version": StringMatching /v\\\\d\\+\\\\\\.\\\\d\\+/,
   "etag": StringMatching /\\(\\?:W\\\\/\\)\\?"\\(\\?:\\[ !#-\\\\x7E\\\\x80-\\\\xFF\\]\\*\\|\\\\r\\\\n\\[\\\\t \\]\\|\\\\\\\\\\.\\)\\*"/,
@@ -22867,7 +22867,7 @@ exports[`Activity Feed API Filter splitting Can use NQL OR for type only 2: [hea
 Object {
   "access-control-allow-origin": "http://127.0.0.1:2369",
   "cache-control": "no-cache, private, no-store, must-revalidate, max-stale=0, post-check=0, pre-check=0",
-  "content-length": "5114",
+  "content-length": "5180",
   "content-type": "application/json; charset=utf-8",
   "content-version": StringMatching /v\\\\d\\+\\\\\\.\\\\d\\+/,
   "etag": StringMatching /\\(\\?:W\\\\/\\)\\?"\\(\\?:\\[ !#-\\\\x7E\\\\x80-\\\\xFF\\]\\*\\|\\\\r\\\\n\\[\\\\t \\]\\|\\\\\\\\\\.\\)\\*"/,
@@ -23914,7 +23914,7 @@ exports[`Activity Feed API Returns comments in activity feed 2: [headers] 1`] =
 Object {
   "access-control-allow-origin": "http://127.0.0.1:2369",
   "cache-control": "no-cache, private, no-store, must-revalidate, max-stale=0, post-check=0, pre-check=0",
-  "content-length": "1238",
+  "content-length": "1304",
   "content-type": "application/json; charset=utf-8",
   "content-version": StringMatching /v\\\\d\\+\\\\\\.\\\\d\\+/,
   "etag": StringMatching /\\(\\?:W\\\\/\\)\\?"\\(\\?:\\[ !#-\\\\x7E\\\\x80-\\\\xFF\\]\\*\\|\\\\r\\\\n\\[\\\\t \\]\\|\\\\\\\\\\.\\)\\*"/,