1 files changed, 13 insertions, 2 deletions
diff --git a/routes/note_fragment.php b/routes/note_fragment.php
index 3d30a7a..3d3c658 100644
--- a/routes/note_fragment.php
+++ b/routes/note_fragment.php
@@ -9,6 +9,7 @@ use Digitigrade\Model\Interaction;
 use Digitigrade\Model\InteractionKind;
 use Digitigrade\Model\Note;
 use Digitigrade\Model\NoteAttachment;
+use Digitigrade\Model\NotePrivacyInteractors;
 use Digitigrade\Model\NotePrivacyScope;
 use Digitigrade\Model\Notification;
 use Digitigrade\Model\StorageObject;
@@ -23,7 +24,7 @@ Router::getInstance()->mount('/fragment/note/:id', function (array $args) {
     if ($_SERVER['REQUEST_METHOD'] != 'DELETE') {
         // just render the note
         // but check the current user is allowed to see it
-        if ($note->privacy->scope != NotePrivacyScope::PUBLIC ) {
+        if ($note->privacy->scope != NotePrivacyScope::PUBLIC) {
             $user = UserAccount::requireByCurrentSession();
             if (!in_array($user->actor, $note->getRelevantActors())) {
                 throw new Forbidden();
@@ -58,6 +59,9 @@ Router::getInstance()->mount('/fragment/note/:id/:action', function (array $args
 
     if ($interaction == null) {
         // we are adding a new interaction
+        if (!$note->isInteractibleBy($action, $user)) {
+            throw new Forbidden("you're not allowed to $action this note!");
+        }
         $interaction = Interaction::create($user->actor, InteractionKind::from($action), $note);
         if (!PolicyManager::getInstance()->check($interaction)) {
             $interaction->remove();
@@ -73,7 +77,7 @@ Router::getInstance()->mount('/fragment/note/:id/:action', function (array $args
         $active = false;
     }
 
-    render_template('interaction_button', [
+    render_template('note/interaction_button', [
         'action' => $args['action'],
         'active' => $active,
         'note' => $note,
@@ -85,6 +89,9 @@ Router::getInstance()->mount('/fragment/note/:id/reply', function (array $args)
     // replying to a note
     $author = UserAccount::requireByCurrentSession();
     $note = Note::find($args['id']);
+    if (!$note->isInteractibleBy('reply', $author)) {
+        throw new Forbidden("you're not allowed to reply to this note!");
+    }
     if (isset($_POST['content']) && strlen(trim($_POST['content'])) > 0) {
         $summary = trim($_POST['summary'] ?? '');
         $summary = $summary == '' ? null : $summary;
@@ -166,6 +173,10 @@ Router::getInstance()->mount('/fragment/note', function (array $args) {
             $summary,
             NotePrivacyScope::from($_POST['scope'])
         );
+        $interactors = NotePrivacyInteractors::from($_POST['interactors']);
+        $note->privacy->canReply = $interactors;
+        $note->privacy->canReshare = $interactors;
+        $note->privacy->canOtherInteract = $interactors;
         $note->formattedContent = [
             'text/markdown' => $content,
             'text/html' => CommonMark::getInstance()->renderToHtml($content)