Comment Plugin

[Jotschi]

The comment plugin should provide REST endpoints which enable a logged in user to:

• create new comments

Comments are either created by logged in Users (User is creator) or by Anonymous User (User Data like Name, eMail is stored in the comment itself)

Admin users are able to:

• publish comments
• remove comments
• edit comments

Domain Model

(projectRoot)->(commentsRoot)->(commentNodeRoot1)->(comment)->(subComment)

Front-end handling

Questions:

• How do we decide whether to display the comments section or not? One option: Show comments if the node has a node reference to the comments root node

Configuration

• It should be possible to configure used template files within a config YAML file.
• It should be possible to scope the configuration to projects and provide a default
• It should be possible globally activate comments (or per project). It should be possible to override this setting via a comments config node.

eMail Handling

The plugin should be able to render email templates and send emails to notify users about new comments.

Setup

• The comment plugin needs to check whether all needed schemas are setup.
• It needs to create the comment root node.
• It needs to create the comment roles.
• It assigns the role perms to the commentsRoot

Open:

• The plugin needs to update the page schema in order to setup the node reference from the page node to the commentsRoot node. (TBD) It would be better to use the planned foreign reference GraphQL field to retrieve the reference to the page node. (reversed direction)

DSGVO

The plugin needs to be able to anonymize the user data and data of anonymous comments. Anonymous comments contain the user data within the comment node. The plugin needs to annotate schema fields which contain personal information.

Comments Configuration

• Comments depth level

Permission Handling

• A user should only be able to read comments if he/she is able to read the page node to which the comments node was attached.
• The comments plugin may need to update the comment permissions if the node permissions change. (e.g. a new role perm was assigned to the page node thus this role needs to be assigned to all comments as well.)
• We need to avoid user roles. The perms should be bound to nodes which have been created by the user.

Roles:

• manage comments
• read comments

API

• /api/v1/:projectName/plugins/comments/
• POST /api/v1/:projectName/plugins/comments/activate/:nodeUuid - Enables comments for the given node and use the provided configuration to setup the commentsRoot

Preview Handling

Comment sections can be embedded via loading a single JavaScript file similar to the way how disqus works.

• /api/v1/:projectName/plugins/comments/static/mesh-comments.js

The script will invoke AJAX calls to the Mesh Comments plugin. The payload needs to contain:

• Project Name
• Comments config
• Parent node uuid

The response will return the rendered comments section

• /api/v1/:projectName/plugins/comments/preview

• Comments should be rendered on client-side only in order to prevent cache invalidation due to the dynamic comment section.

reCAPTCHA

The plugin needs to be able to validate the reCAPTCHA data.

Questions:

• Should it be possible to configure the captcha mechanism?
• Should it be possible to turn off the captcha mechanism?
• Should we add the reCAPTCHA validation code to a common plugin base library?

Form Validation

Questions:

• Do we want to limit the form value format? Should we strip HTML?
• Do we want to support markup (e.g. handlebars?) -> Not at the moment
• Should we perhaps enhance the schema fields to enable automatic html stripping, field validation?

Gentics CMS support

The tagtype for comments should be provided via a devtools package.

Requirements:

• https://www.gentics.com/Portal.Node-PHP/guides/widget_comments.html

[philippguertler]

Some more remarks:

• referencedBy edge would be nice for performance gain
• CMS publishing to Mesh needs to be ordered (first publish page, then comment configuration)

[Jotschi]

Open:

• [x] Add CMS reference tagtype -
• [x] Add frontend library to load the comments -
• [ ] Add management area to administrate the comments (tagtype provides admin functionality)
• [ ] Either add reference to each comment to quickly find all comments of a specific node/page (0.5PT) or add a way to recursively list all nodes below a specified node (3PT)
• [ ] reCAPTCHA support
• [ ] Keycloak integration #406
• [ ] Comment approval
• [ ] Integration tests - 1 PT
• [ ] Check whether the mesh user should be referenced instead of a username field. (This will not work with anonymous comments)

Later:

• [ ] Add endpoint to quickly retrieve / delete comments of a certain user

Idea:

• User should be able to register for updates on new comments in a section
• Question: Should this work for anonymous users as well?
• This would require an additional storage location.
• We would need to add an opt-out feature to opt-out of all mails