fix(backend): hide non-public replies to comments in event comment threads

Signed-off-by: Thomas Citharel <tcit@tcit.fr>

lib/graphql/schema/discussions/comment.ex

@@ -4,7 +4,7 @@ defmodule Mobilizon.GraphQL.Schema.Discussions.CommentType do
   """
   use Absinthe.Schema.Notation
 
-  import Absinthe.Resolution.Helpers, only: [dataloader: 1]
+  import Absinthe.Resolution.Helpers, only: [dataloader: 1, dataloader: 2]
 
   alias Mobilizon.{Actors, Discussions, Events}
   alias Mobilizon.GraphQL.Resolvers.Comment
@@ -23,7 +23,7 @@ defmodule Mobilizon.GraphQL.Schema.Discussions.CommentType do
 
     field(:replies, list_of(:comment)) do
       description("A list of replies to the comment")
-      resolve(dataloader(Discussions))
+      resolve(dataloader(Discussions, args: %{replies: true}))
     end
 
     field(:total_replies, :integer,

lib/mobilizon/discussions/discussions.ex

@@ -85,6 +85,13 @@ defmodule Mobilizon.Discussions do
     |> select([c, r], %{c | total_replies: count(r.id)})
   end
 
+  # Replies are only used on event comments, so we always use public visibily here
+  def query(Comment, %{replies: true}) do
+    Comment
+    |> where([c], c.visibility in ^@public_visibility)
+    |> order_by([c], asc: :is_announcement, asc: :published_at)
+  end
+
   def query(Comment, _) do
     order_by(Comment, [c], asc: :is_announcement, asc: :published_at)
   end