Add CommentPolicy to enforce business rules for comments

[annikaholmqvist94]

• Implemented rules for creating, viewing, updating, and deleting comments.
• Enforced role-based access control and record status validations.

Summary by CodeRabbit

• New Features
  • Comment creation and editing are blocked on finalized medical records.
  • Viewing and management of comments are now role-restricted: record owners can act only on their own records, veterinarians only for records tied to their clinic, and administrators have full access.
  • Deletion of comments is limited to administrators or the original comment authors.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 6a5aae82-a1e3-44a4-908d-c1e349017d90

📥 Commits

Reviewing files that changed from the base of the PR and between c0154f7 and 328883b.

📒 Files selected for processing (1)

• src/main/java/org/example/vet1177/policy/CommentPolicy.java

🚧 Files skipped from review as they are similar to previous changes (1)

• src/main/java/org/example/vet1177/policy/CommentPolicy.java

---

📝 Walkthrough

Walkthrough

New Spring @Component CommentPolicy centralizes authorization and business-rule checks for comment create/view/update/delete operations, enforcing role-based access (OWNER, VET, ADMIN), author-only edit/delete, and blocking actions on finalized medical records.

Changes

Cohort / File(s)	Summary
Comment Policy Authorization src/main/java/org/example/vet1177/policy/CommentPolicy.java	Added new Spring @Component implementing four public methods: canCreate(User, MedicalRecord), canView(User, MedicalRecord), canUpdate(User, Comment), canDelete(User, Comment). Enforces finalization checks, role-based restrictions (OWNER, VET, ADMIN), author-only edit/delete, and throws BusinessRuleException or ForbiddenException accordingly.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• Add Comment entity and CommentRepository #28: Introduced Comment and MedicalRecord entities that CommentPolicy depends on.

Suggested labels

enhancement

Suggested reviewers

• johanbriger
• lindaeskilsson
• TatjanaTrajkovic

Poem

🐰 A quiet policy hops into place,
Guarding comments with careful grace.
Owner, vet, admin—roles in rhyme,
Final record halts the write each time.
I nibble rules and stamp them true; hooray for safe review! 🥕✨

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title directly and accurately describes the main change: addition of a new CommentPolicy component that enforces business rules for comment operations.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/comment-policy

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 2

🧹 Nitpick comments (1)

src/main/java/org/example/vet1177/policy/CommentPolicy.java (1)

44-53: ADMIN cannot update others' comments but can delete them.

canUpdate restricts editing to the original author only, while canDelete allows ADMIN to delete any comment. If this asymmetry is intentional (e.g., preserving audit integrity), consider adding a comment to clarify the design decision.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@src/main/java/org/example/vet1177/policy/CommentPolicy.java` around lines 44
- 53, The canUpdate method in CommentPolicy only allows the comment author to
edit while canDelete permits ADMIN to delete others' comments, creating an
asymmetry; add a concise explanatory comment above the canUpdate and/or
canDelete methods in CommentPolicy explaining this intentional design (e.g.,
"Admins may delete comments for moderation/audit reasons, but edits are
restricted to original authors to preserve audit integrity"), referencing the
methods canUpdate and canDelete and the reason (audit integrity/moderation) so
future readers understand the rationale.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/main/java/org/example/vet1177/policy/CommentPolicy.java`:
- Around line 31-41: The switch on user.getRole() in CommentPolicy contains the
same NPE risk and missing default as canCreate—add a null-check for
user.getRole() (and any nested calls like user.getClinic(), record.getClinic(),
record.getOwner()) before switching and/or short-circuit with a
ForbiddenException if any required field is null, and add a default case in the
switch that throws ForbiddenException to guard against unknown roles; update the
relevant method in CommentPolicy (the switch block shown) to validate these
fields and throw ForbiddenException when null or unrecognized role is
encountered.
- Around line 17-27: The switch in CommentPolicy that branches on user.getRole()
has two issues: the VET branch dereferences user.getClinic() (risking NPE) and
there's no default branch for unknown roles. Fix by adding null-safe checks in
the VET branch (e.g., if user.getClinic() == null || record.getClinic() == null
|| !user.getClinic().getId().equals(record.getClinic().getId()) then throw new
ForbiddenException(...)) and add a default case in the switch that throws
ForbiddenException to deny access for unrecognized roles; keep the existing
OWNER check (consider null-safe owner check if needed) and leave ADMIN explicit
but do not rely on silent fall-through.

---

Nitpick comments:
In `@src/main/java/org/example/vet1177/policy/CommentPolicy.java`:
- Around line 44-53: The canUpdate method in CommentPolicy only allows the
comment author to edit while canDelete permits ADMIN to delete others' comments,
creating an asymmetry; add a concise explanatory comment above the canUpdate
and/or canDelete methods in CommentPolicy explaining this intentional design
(e.g., "Admins may delete comments for moderation/audit reasons, but edits are
restricted to original authors to preserve audit integrity"), referencing the
methods canUpdate and canDelete and the reason (audit integrity/moderation) so
future readers understand the rationale.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: f9d2c9f1-92b3-4da9-8d90-7158a0715ce1

📥 Commits

Reviewing files that changed from the base of the PR and between 02f25bb and c0154f7.

📒 Files selected for processing (1)

• src/main/java/org/example/vet1177/policy/CommentPolicy.java