From fd0b203f1e001152dfaf49e49abccf157cd940e3 Mon Sep 17 00:00:00 2001
From: rubenwardy <rw@rubenwardy.com>
Date: Wed, 9 Dec 2020 18:40:25 +0000
Subject: [PATCH] Add ability to delete threads

This reverts commit 78630b30715cb46b5695f8aba8443ffcfd4c67e5.
---
 app/blueprints/threads/__init__.py       | 25 +++++++++++++++++++++++-
 app/models.py                            |  5 +++--
 app/templates/threads/delete_thread.html | 22 +++++++++++++++++++++
 app/templates/threads/view.html          |  7 +++++--
 4 files changed, 54 insertions(+), 5 deletions(-)
 create mode 100644 app/templates/threads/delete_thread.html

diff --git a/app/blueprints/threads/__init__.py b/app/blueprints/threads/__init__.py
index c19d823d..e99136f4 100644
--- a/app/blueprints/threads/__init__.py
+++ b/app/blueprints/threads/__init__.py
@@ -22,12 +22,12 @@ bp = Blueprint("threads", __name__)
 from flask_login import current_user, login_required
 from app.models import *
 from app.utils import addNotification, isYes, addAuditLog
-
 from flask_wtf import FlaskForm
 from wtforms import *
 from wtforms.validators import *
 from app.utils import get_int_or_abort
 
+
 @bp.route("/threads/")
 def list_all():
 	query = Thread.query
@@ -107,6 +107,29 @@ def set_lock(id):
 
 @bp.route("/threads/<int:id>/delete/", methods=["GET", "POST"])
 @login_required
+def delete_thread(id):
+	thread = Thread.query.get(id)
+	if thread is None or not thread.checkPerm(current_user, Permission.DELETE_THREAD):
+		abort(404)
+
+	if request.method == "GET":
+		return render_template("threads/delete_thread.html", thread=thread)
+
+	summary = "\n\n".join([("<{}> {}".format(reply.author.display_name, reply.comment)) for reply in thread.replies])
+
+	msg = "Deleted thread {} by {}".format(thread.title, thread.author.display_name)
+
+	db.session.delete(thread)
+
+	addAuditLog(AuditSeverity.MODERATION, current_user, msg, None, thread.package, summary)
+
+	db.session.commit()
+
+	return redirect(url_for("homepage.home"))
+
+
+@bp.route("/threads/<int:id>/delete-reply/", methods=["GET", "POST"])
+@login_required
 def delete_reply(id):
 	thread = Thread.query.get(id)
 	if thread is None:
diff --git a/app/models.py b/app/models.py
index 4212d3da..eb5fb0df 100644
--- a/app/models.py
+++ b/app/models.py
@@ -94,6 +94,7 @@ class Permission(enum.Enum):
 	CREATE_THREAD      = "CREATE_THREAD"
 	COMMENT_THREAD     = "COMMENT_THREAD"
 	LOCK_THREAD        = "LOCK_THREAD"
+	DELETE_THREAD      = "DELETE_THREAD"
 	DELETE_REPLY       = "DELETE_REPLY"
 	EDIT_REPLY         = "EDIT_REPLY"
 	UNAPPROVE_PACKAGE  = "UNAPPROVE_PACKAGE"
@@ -1352,7 +1353,7 @@ class Thread(db.Model):
 	created_at = db.Column(db.DateTime, nullable=False, default=datetime.datetime.utcnow)
 
 	replies    = db.relationship("ThreadReply", back_populates="thread", lazy="dynamic",
-			order_by=db.asc("thread_reply_id"))
+			order_by=db.asc("thread_reply_id"), cascade="all, delete, delete-orphan")
 
 	watchers   = db.relationship("User", secondary=watchers, lazy="subquery", backref="watching")
 
@@ -1386,7 +1387,7 @@ class Thread(db.Model):
 		elif perm == Permission.COMMENT_THREAD:
 			return canSee and (not self.locked or user.rank.atLeast(UserRank.MODERATOR))
 
-		elif perm == Permission.LOCK_THREAD:
+		elif perm == Permission.LOCK_THREAD or perm == Permission.DELETE_THREAD:
 			return user.rank.atLeast(UserRank.MODERATOR)
 
 		else:
diff --git a/app/templates/threads/delete_thread.html b/app/templates/threads/delete_thread.html
new file mode 100644
index 00000000..7da540a9
--- /dev/null
+++ b/app/templates/threads/delete_thread.html
@@ -0,0 +1,22 @@
+{% extends "base.html" %}
+
+{% block title %}
+	Delete thread in {{ thread.title }}
+{% endblock %}
+
+{% block content %}
+	<form method="POST" action="" class="card box_grey">
+		<input type="hidden" name="csrf_token" value="{{ csrf_token() }}" />
+
+		<h3 class="card-header">Delete {{ thread.title }} by {{ thread.author.display_name }}</h3>
+		<div class="card-body">
+			{{ thread.replies[0].comment | markdown }}
+		</div>
+		<div class="card-body">
+			<p>Deleting is permanent</p>
+
+			<a class="btn btn-secondary mr-3" href="{{ thread.getViewURL() }}">Cancel</a>
+			<input type="submit" value="Delete" class="btn btn-danger" />
+		</div>
+	</form>
+{% endblock %}
diff --git a/app/templates/threads/view.html b/app/templates/threads/view.html
index f92ef399..7c6987be 100644
--- a/app/templates/threads/view.html
+++ b/app/templates/threads/view.html
@@ -17,16 +17,19 @@
 				<input type="submit" class="btn btn-primary" value="Subscribe" />
 			</form>
 		{% endif %}
+		{% if thread and thread.checkPerm(current_user, "DELETE_THREAD") %}
+			<a href="{{ url_for('threads.delete_thread', id=thread.id) }}" class="float-right mr-2 btn btn-danger">{{ _('Delete') }}</a>
+		{% endif %}
 		{% if thread and thread.checkPerm(current_user, "LOCK_THREAD") %}
 			{% if thread.locked %}
 				<form method="post" action="{{ url_for('threads.set_lock', id=thread.id, lock=0) }}" class="float-right mr-2">
 					<input type="hidden" name="csrf_token" value="{{ csrf_token() }}" />
-					<input type="submit" class="btn btn-secondary" value="{{ _('Unlock Thread') }}" />
+					<input type="submit" class="btn btn-secondary" value="{{ _('Unlock') }}" />
 				</form>
 			{% else %}
 				<form method="post" action="{{ url_for('threads.set_lock', id=thread.id, lock=1) }}" class="float-right mr-2">
 					<input type="hidden" name="csrf_token" value="{{ csrf_token() }}" />
-					<input type="submit" class="btn btn-secondary" value="{{ _('Lock Thread') }}" />
+					<input type="submit" class="btn btn-secondary" value="{{ _('Lock') }}" />
 				</form>
 			{% endif %}
 		{% endif %}