allow moderators to read hidden notes through API

diff --git a/app/controllers/notes_controller.rb b/app/controllers/notes_controller.rb
index 853072b7bbc2134758526a32325e4e2136ce1b09..9d156ea1d15e492f43ab1ed65fb787073a2a8f74 100644 (file)
--- a/app/controllers/notes_controller.rb
+++ b/app/controllers/notes_controller.rb
@@ -4,7 +4,7 @@ class NotesController < ApplicationController
   skip_before_action :verify_authenticity_token, :except => [:mine]
   before_action :check_api_readable
   before_action :authorize_web, :only => [:mine]
-  before_action :setup_user_auth, :only => [:create, :comment]
+  before_action :setup_user_auth, :only => [:create, :comment, :show]
   before_action :authorize, :only => [:close, :reopen, :destroy]
   before_action :require_moderator, :only => [:destroy]
   before_action :check_api_writable, :only => [:create, :comment, :close, :reopen, :destroy]
@@ -211,7 +211,7 @@ class NotesController < ApplicationController
     # Find the note and check it is valid
     @note = Note.find(params[:id])
     raise OSM::APINotFoundError unless @note
-    raise OSM::APIAlreadyDeletedError.new("note", @note.id) unless @note.visible?
+    raise OSM::APIAlreadyDeletedError.new("note", @note.id) unless @note.visible? || (current_user && current_user.moderator?)
 
     # Render the result
     respond_to do |format|

diff --git a/test/controllers/notes_controller_test.rb b/test/controllers/notes_controller_test.rb
index 4444a2f50b5513bb24c1bd82e301981da47a53ab..1ebce60b53dcfa8659612e0f31a0b7061005e9f7 100644 (file)
--- a/test/controllers/notes_controller_test.rb
+++ b/test/controllers/notes_controller_test.rb
@@ -625,6 +625,10 @@ class NotesControllerTest < ActionController::TestCase
     assert_equal "This is a hide comment", js["properties"]["comments"].last["text"]
     assert_equal moderator_user.display_name, js["properties"]["comments"].last["user"]
 
+    get :show, :params => { :id => open_note_with_comment.id, :format => "json" }
+    assert_response :success
+
+    basic_authorization user.email, "test"
     get :show, :params => { :id => open_note_with_comment.id, :format => "json" }
     assert_response :gone
   end