Hannes Heine · 5f4bf58d
--- a/backend/src/middleware/permissionsMiddleware.js
+++ b/backend/src/middleware/permissionsMiddleware.js
 })

+const canCommentPost = rule({
+ cache: 'no_cache',
+})(async (_parent, args, { user, driver }) => {
+ if (!(user && user.id)) return false
+ const { postId } = args
+ const userId = user.id
+ const session = driver.session()
+ const readTxPromise = session.readTransaction(async (transaction) => {
+   const transactionResponse = await transaction.run(
+     `
+       MATCH (post:Post { id: $postId })
+       OPTIONAL MATCH (post)-[:IN]->(group:Group)
+       OPTIONAL MATCH (user:User { id: $userId })-[membership:MEMBER_OF]->(group)
+       RETURN group AS group, membership AS membership