(answer) 03/06: fix: align question operation permissions

[li...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

LinkinStars pushed a commit to branch fix/2.0.3/user
in repository https://gitbox.apache.org/repos/asf/answer.git

commit 21e0714a0876c6b2e3e8eee44178d97846c6bcb3
Author: LinkinStars <li...@foxmail.com>
AuthorDate: Fri Aug 14 17:03:23 2026 +0800

    fix: align question operation permissions
---
 internal/controller/question_controller.go      | 23 ++++++++----
 internal/controller/question_controller_test.go | 49 +++++++++++++++++++++++++
 2 files changed, 65 insertions(+), 7 deletions(-)

diff --git a/internal/controller/question_controller.go b/internal/controller/question_controller.go
index 05ad319a..644e3097 100644
--- a/internal/controller/question_controller.go
+++ b/internal/controller/question_controller.go
@@ -144,13 +144,7 @@ func (qc *QuestionController) OperationQuestion(ctx *gin.Context) {
 		handler.HandleResponse(ctx, err, nil)
 		return
 	}
-	req.CanPin = canList[0]
-	req.CanList = canList[1]
-	if (req.Operation == schema.QuestionOperationPin || req.Operation == schema.QuestionOperationUnPin) && !req.CanPin {
-		handler.HandleResponse(ctx, errors.Forbidden(reason.RankFailToMeetTheCondition), nil)
-		return
-	}
-	if (req.Operation == schema.QuestionOperationHide || req.Operation == schema.QuestionOperationShow) && !req.CanList {
+	if !canOperateQuestion(req.Operation, canList) {
 		handler.HandleResponse(ctx, errors.Forbidden(reason.RankFailToMeetTheCondition), nil)
 		return
 	}
@@ -158,6 +152,21 @@ func (qc *QuestionController) OperationQuestion(ctx *gin.Context) {
 	handler.HandleResponse(ctx, err, nil)
 }
 
+func canOperateQuestion(operation string, canList []bool) bool {
+	switch operation {
+	case schema.QuestionOperationPin:
+		return canList[0]
+	case schema.QuestionOperationUnPin:
+		return canList[1]
+	case schema.QuestionOperationHide:
+		return canList[2]
+	case schema.QuestionOperationShow:
+		return canList[3]
+	default:
+		return true
+	}
+}
+
 // CloseQuestion Close question
 // @Summary Close question
 // @Description Close question
diff --git a/internal/controller/question_controller_test.go b/internal/controller/question_controller_test.go
new file mode 100644
index 00000000..35d75f41
--- /dev/null
+++ b/internal/controller/question_controller_test.go
@@ -0,0 +1,49 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package controller
+
+import (
+	"testing"
+
+	"github.com/apache/answer/internal/schema"
+)
+
+func TestCanOperateQuestionUsesMatchingPermission(t *testing.T) {
+	testCases := []struct {
+		name      string
+		operation string
+		canList   []bool
+		want      bool
+	}{
+		{"pin", schema.QuestionOperationPin, []bool{true, false, false, false}, true},
+		{"unpin", schema.QuestionOperationUnPin, []bool{false, true, false, false}, true},
+		{"hide", schema.QuestionOperationHide, []bool{false, false, true, false}, true},
+		{"show", schema.QuestionOperationShow, []bool{false, false, false, true}, true},
+		{"unpin does not authorize hide", schema.QuestionOperationHide, []bool{false, true, false, false}, false},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			if got := canOperateQuestion(testCase.operation, testCase.canList); got != testCase.want {
+				t.Fatalf("canOperateQuestion(%q, %v) = %v, want %v", testCase.operation, testCase.canList, got, testCase.want)
+			}
+		})
+	}
+}