✨ Added ability to ban members from commenting

ref https://linear.app/ghost/issue/FEA-487

Adds a `can_comment` boolean field to the Member model that allows admins
to ban specific members from commenting. When set to false, the member
cannot create new comments or replies.

Author: rob-ghost

ghost/core/core/server/api/endpoints/utils/serializers/output/mappers/comments.js

@@ -19,7 +19,8 @@ const memberFields = [
     'uuid',
     'name',
     'expertise',
-    'avatar_image'
+    'avatar_image',
+    'can_comment'
 ];
 
 const memberFieldsAdmin = [
@@ -28,7 +29,8 @@ const memberFieldsAdmin = [
     'name',
     'email',
     'expertise',
-    'avatar_image'
+    'avatar_image',
+    'can_comment'
 ];
 
 const postFields = [

ghost/core/core/server/api/endpoints/utils/serializers/output/members.js

@@ -178,6 +178,7 @@ function serializeMember(member, options) {
         email_recipients: json.email_recipients,
         status: json.status,
         last_seen_at: json.last_seen_at,
+        can_comment: json.can_comment,
         attribution: serializeAttribution(json.attribution),
         unsubscribe_url: json.unsubscribe_url
     };

ghost/core/core/server/data/migrations/versions/6.11/2025-12-18-15-58-00-add-can-comment-to-members.js

@@ -0,0 +1,7 @@
+const {createAddColumnMigration} = require('../../utils');
+
+module.exports = createAddColumnMigration('members', 'can_comment', {
+    type: 'boolean',
+    nullable: false,
+    defaultTo: true
+});

ghost/core/core/server/data/schema/schema.js

@@ -429,6 +429,7 @@ module.exports = {
         note: {type: 'string', maxlength: 2000, nullable: true},
         geolocation: {type: 'string', maxlength: 2000, nullable: true},
         enable_comment_notifications: {type: 'boolean', nullable: false, defaultTo: true},
+        can_comment: {type: 'boolean', nullable: false, defaultTo: true},
         email_count: {type: 'integer', unsigned: true, nullable: false, defaultTo: 0},
         email_opened_count: {type: 'integer', unsigned: true, nullable: false, defaultTo: 0},
         email_open_rate: {type: 'integer', unsigned: true, nullable: true, index: true},

ghost/core/core/server/models/member.js

@@ -16,7 +16,8 @@ const Member = ghostBookshelf.Model.extend({
             transient_id: crypto.randomUUID(),
             email_count: 0,
             email_opened_count: 0,
-            enable_comment_notifications: true
+            enable_comment_notifications: true,
+            can_comment: true
         };
     },
 

ghost/core/core/server/services/comments/CommentsService.js

@@ -11,7 +11,8 @@ const messages = {
     replyToReply: 'Can not reply to a reply',
     commentsNotEnabled: 'Comments are not enabled for this site.',
     cannotCommentOnPost: 'You do not have permission to comment on this post.',
-    cannotEditComment: 'You do not have permission to edit comments'
+    cannotEditComment: 'You do not have permission to edit comments',
+    memberCannotComment: 'You do not have permission to comment.'
 };
 
 class CommentsService {
@@ -61,6 +62,12 @@ class CommentsService {
 
     /** @private */
     checkCommentAccess(memberModel) {
+        if (memberModel.get('can_comment') === false) {
+            throw new errors.NoPermissionError({
+                message: tpl(messages.memberCannotComment)
+            });
+        }
+
         if (this.enabled === 'paid' && memberModel.get('status') === 'free') {
             throw new errors.NoPermissionError({
                 message: tpl(messages.cannotCommentOnPost)

ghost/core/core/server/services/members/members-api/repositories/MemberRepository.js

@@ -505,6 +505,7 @@ module.exports = class MemberRepository {
             'products',
             'newsletters',
             'enable_comment_notifications',
+            'can_comment',
             'last_seen_at',
             'last_commented_at',
             'expertise',

ghost/core/test/e2e-api/admin/members.test.js

@@ -2397,6 +2397,86 @@ describe('Members API', function () {
         });
     });
 
+    describe('can_comment', function () {
+        let testMember;
+
+        beforeEach(async function () {
+            testMember = await createMember({
+                email: 'can-comment-test@test.com',
+                name: 'Test Member for can_comment'
+            });
+        });
+
+        afterEach(async function () {
+            await models.Member.destroy({id: testMember.id});
+        });
+
+        it('New members can comment by default', async function () {
+            should(testMember.get('can_comment')).be.true();
+        });
+
+        it('Can ban a member from commenting', async function () {
+            // Verify member can comment by default
+            should(testMember.get('can_comment')).be.true();
+
+            // Ban member from commenting
+            const {body} = await agent
+                .put(`/members/${testMember.id}/`)
+                .body({members: [{can_comment: false}]})
+                .expectStatus(200);
+
+            // Verify response includes can_comment: false
+            should(body.members[0].can_comment).be.false();
+
+            // Verify database was updated
+            await testMember.refresh();
+            should(testMember.get('can_comment')).be.false();
+        });
+
+        it('Can unban a member from commenting', async function () {
+            // First ban the member
+            await agent
+                .put(`/members/${testMember.id}/`)
+                .body({members: [{can_comment: false}]})
+                .expectStatus(200);
+
+            await testMember.refresh();
+            should(testMember.get('can_comment')).be.false();
+
+            // Now unban the member
+            const {body} = await agent
+                .put(`/members/${testMember.id}/`)
+                .body({members: [{can_comment: true}]})
+                .expectStatus(200);
+
+            // Verify response includes can_comment: true
+            should(body.members[0].can_comment).be.true();
+
+            // Verify database was updated
+            await testMember.refresh();
+            should(testMember.get('can_comment')).be.true();
+        });
+
+        it('Returns can_comment in member read response', async function () {
+            const {body} = await agent
+                .get(`/members/${testMember.id}/`)
+                .expectStatus(200);
+
+            should(body.members[0]).have.property('can_comment');
+            should(body.members[0].can_comment).be.true();
+        });
+
+        it('Returns can_comment in member browse response', async function () {
+            const {body} = await agent
+                .get(`/members/?filter=email:can-comment-test@test.com`)
+                .expectStatus(200);
+
+            should(body.members.length).be.greaterThan(0);
+            should(body.members[0]).have.property('can_comment');
+            should(body.members[0].can_comment).be.true();
+        });
+    });
+
     // Log out
     it('Can log out', async function () {
         const member = await createMember({

ghost/core/test/unit/server/data/schema/integrity.test.js

@@ -35,7 +35,7 @@ const validateRouteSettings = require('../../../../../core/server/services/route
  */
 describe('DB version integrity', function () {
     // Only these variables should need updating
-    const currentSchemaHash = '840147221764a9de1b3807e3abb61df2';
+    const currentSchemaHash = '1854d277d90759f76a1e971ecd545b3a';
     const currentFixturesHash = 'c583f33910bb84a70847303b323be2db';
     const currentSettingsHash = 'bb8be7d83407f2b4fa2ad68c19610579';
     const currentRoutesHash = '3d180d52c663d173a6be791ef411ed01';