🔒️(backend) require present document access for thread/comment writes

[lunika]

Purpose

The comment permission/abilities were not checking if the current user
still have access to the document, it was only checking if it is the
creator to allow it to perform update and destroy actions.
We now check the document's comment abilities before checking if it can
update or destroy a comment/thread

Proposal

• 🔒️(backend) require present document access for thread/comment writes

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 5d4a28fd-bc2a-4e3d-920a-12b6ef3d14c4

📥 Commits

Reviewing files that changed from the base of the PR and between 040b9f1 and 33f9ae1.

📒 Files selected for processing: 6

• CHANGELOG.md
• src/backend/core/api/permissions.py
• src/backend/core/models.py
• src/backend/core/tests/documents/test_api_documents_comments.py
• src/backend/core/tests/documents/test_api_documents_threads.py
• src/backend/core/tests/test_models_comment.py

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

Walkthrough

Thread and comment permission checks now require current document access. Model abilities and API tests cover access revocation, including rejected writes and unchanged stored state.

Priority: ⬇️ Low

Estimated code review effort: 3 (Moderate) | ~20 minutes

Suggested reviewers: antolc

Fixed issue severity: <fixed_issue_severity>Medium</fixed_issue_severity>

Merge Risk: ⚪ Minimal · up to 33f9a

No actionable merge-blocking issue remains in the supplied review evidence; the change is ready for normal merge checks.

Pre-merge checks: 5

Passed checks: 5 passed

Check name	Status	Explanation
Title check		The title clearly and concisely describes the main change: requiring current document access for thread and comment writes.
Description check		The description directly explains the authorization issue and the proposed fix for comment and thread updates and deletions.
Docstring Coverage		Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 22 functions across 5 files. (1 skipped: 1…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}