Gate RS comment moderation on the moderate_comments capability (#23123)

* Gate RS comment moderation on the moderate_comments capability

Non-admin users were shown fully active moderation controls in the new
RS comments screens; tapping them only failed server-side with a 403.

Fetch the current user's moderate_comments capability via wordpress-rs
(reusing SiteCapabilityChecker) and, when absent, disable and dim the
moderation controls on both the detail footer and the list's batch
actions. Like, copy/share link and reply stay active. The capability
handlers are also guarded in the ViewModels as defense-in-depth.

SiteCapabilityChecker now keys its cache by the local site id instead of
site.siteId, which is 0 for every app-password self-hosted site and would
otherwise collide their capabilities.

* Suppress ReturnCount detekt warning on onEditClicked

* Gray out disabled moderation controls in RS comment footer

Show the accent tint only on enabled on-toggles (approved/liked) and let
disabled moderation controls fall back to the grayed-out disabled color,
including the destructive red menu items, so a non-moderator no longer sees
tappable-looking controls.

* Address RS comment moderation review findings

- Always attempt the implicit approve when replying to an unapproved
  comment, rather than gating on the async-fetched canModerate flag: a
  moderator replying before the capability resolved (e.g. from a
  notification with the reply field focused) would otherwise silently
  drop the approve. approveAfterReply() reverts on server rejection, so a
  non-moderator's reply self-heals either way.
- Don't cache a failed capability fetch: return a fail-closed value for
  that call but retry on the next one, so a transient error no longer
  disables moderation for the whole session.
- Use a ConcurrentHashMap for the capability cache now that the singleton
  is read/written from multiple ViewModels on the default dispatcher.
- Rework SiteCapabilityCheckerTest with a success-path mock covering the
  capability mapping, single-fetch caching, per-site keying, and the
  failed-fetch-is-retried behavior.

* Assign moderation capability directly to the field

Drop the shadowing local and the qualified receiver in
loadModerationCapability by assigning the fetch result straight to the
canModerate field.

* Drop data-class mocks from SiteCapabilityCheckerTest

The success-path mock helper mocked wordpress-rs data classes, tripping
the DoNotMockDataClass lint rule (Debug-variant lint, which CI runs for
PRs). Revert to failure-path-only tests: they cover the fail-closed and
no-cache-on-failure behavior without mocking data classes. The success
path can't be unit-tested here (UserCapabilitiesMap.hasCap is native) and
is covered by the ViewModel tests.

* Gate RS comments on application password only, like RS posts/pages

shouldUseRsComments admitted WP.com-accessed sites too; the RS posts and
pages gates both use application password only. Drop the isUsingWpComRestApi
branch so the three RS gates are consistent — RS comments are now used only
for self-hosted sites with an application password (still behind the
RS_UNIFIED_COMMENTS flag, matching the pages gate).

Author: nbradbury

WordPress/src/main/java/org/wordpress/android/ui/ActivityLauncher.java

@@ -753,9 +753,10 @@ public static void viewUnifiedComments(Context context, SiteModel site) {
      * be used for {@code site} instead of the legacy (FluxC) ones.
      */
     public static boolean shouldUseRsComments(@NonNull Context context, @NonNull SiteModel site) {
-        // The rs client can only authenticate WP.com-accessed sites or self-hosted sites with an
-        // application password; everywhere else keep the legacy (FluxC) comments screens.
-        if (!site.isUsingWpComRestApi() && !site.hasApplicationPassword()) {
+        // Match the RS posts/pages gate: use the rs comments screens only for self-hosted sites
+        // with an application password, and keep the legacy (FluxC) comments screens everywhere
+        // else (including WP.com-accessed sites).
+        if (!site.hasApplicationPassword()) {
             return false;
         }
         ActivityLauncherEntryPoint entryPoint = EntryPointAccessors.fromApplication(

WordPress/src/main/java/org/wordpress/android/ui/comments/unified/UnifiedCommentDetailsViewModel.kt

@@ -28,6 +28,7 @@ import org.wordpress.android.ui.comments.unified.CommentIdentifier.NotificationC
 import org.wordpress.android.ui.comments.unified.CommentIdentifier.SiteCommentIdentifier
 import org.wordpress.android.ui.comments.unified.CommentsRsDataSource.RsComment
 import org.wordpress.android.ui.comments.unified.CommentsRsDataSource.RsResult
+import org.wordpress.android.ui.mysite.items.listitem.SiteCapabilityChecker
 import org.wordpress.android.ui.notifications.utils.NotificationsActionsWrapper
 import org.wordpress.android.ui.pages.SnackbarMessageHolder
 import org.wordpress.android.ui.utils.UiString
@@ -63,6 +64,7 @@ class UnifiedCommentDetailsViewModel @Inject constructor(
     @Named(BG_THREAD) private val bgDispatcher: CoroutineDispatcher,
     private val commentsRsDataSource: CommentsRsDataSource,
     private val commentsStore: CommentsStore,
+    private val siteCapabilityChecker: SiteCapabilityChecker,
     private val localCommentCacheUpdateHandler: LocalCommentCacheUpdateHandler,
     private val networkUtilsWrapper: NetworkUtilsWrapper,
     private val dateTimeUtilsWrapper: DateTimeUtilsWrapper,
@@ -102,13 +104,26 @@ class UnifiedCommentDetailsViewModel @Inject constructor(
     private var isLikeInProgress = false
     private var isModerationInProgress = false
 
+    // Whether the current user may moderate comments on this site (moderate_comments capability).
+    // Fetched asynchronously in [start]; false until it resolves so the moderation controls start
+    // disabled and enable once confirmed, rather than flashing enabled then greying out.
+    private var canModerate = false
+
     fun start(site: SiteModel, remoteCommentId: Long, noteId: String? = null) {
         if (isStarted) return
         isStarted = true
         this.site = site
         this.remoteCommentId = remoteCommentId
         this.noteId = noteId
         loadComment()
+        loadModerationCapability()
+    }
+
+    private fun loadModerationCapability() {
+        launch {
+            canModerate = withContext(bgDispatcher) { siteCapabilityChecker.canModerateComments(site) }
+            _uiState.value?.let { _uiState.value = it.copy(canModerate = canModerate) }
+        }
     }
 
     /**
@@ -226,8 +241,12 @@ class UnifiedCommentDetailsViewModel @Inject constructor(
         }
     }
 
+    @Suppress("ReturnCount")
     fun onEditClicked() {
         if (loadedComment == null) return
+        // Editing a comment needs moderation rights; the button is disabled without them, but guard
+        // the action too so nothing (e.g. a stale recomposition) can slip past the disabled UI.
+        if (!canModerate) return
         // The editor loads the comment from the network, so don't open it offline.
         if (isOffline()) return
         trackCommentAction(Stat.COMMENT_EDITOR_OPENED)
@@ -273,7 +292,12 @@ class UnifiedCommentDetailsViewModel @Inject constructor(
             } else {
                 trackCommentReply(comment)
                 _commentChanged.value = Event(Unit)
-                // Replying to an unapproved comment implicitly approves it, matching legacy behaviour
+                // Replying to an unapproved comment implicitly approves it, matching legacy
+                // behaviour. Always attempt it rather than gating on canModerate: that flag is
+                // fetched asynchronously and may still be unresolved when a moderator replies
+                // (e.g. from a notification, reply field pre-focused), which would silently drop
+                // the approve. approveAfterReply() flips the status optimistically and reverts if
+                // the server rejects it, so a non-moderator's reply self-heals either way.
                 if (currentStatus() == UNAPPROVED) {
                     approveAfterReply()
                 }
@@ -314,6 +338,9 @@ class UnifiedCommentDetailsViewModel @Inject constructor(
         // before the load completes the ui state holds a default status and the toggle handlers
         // would compute (and apply server-side) the wrong target status.
         if (loadedComment == null) return
+        // Moderation controls are disabled without the capability; guard the action too so a stale
+        // recomposition can't fire a request the server would only reject with a 403.
+        if (!canModerate) return
         if (isOffline()) return
         // Guard against a second moderation while one is in flight (fast double-tap): the target
         // status is derived from the optimistic ui state, so racing requests could compute (and
@@ -445,7 +472,8 @@ class UnifiedCommentDetailsViewModel @Inject constructor(
         postTitle = cached?.postTitle?.takeIf { it.isNotBlank() } ?: fallbackPostTitle,
         commentUrl = url,
         status = status,
-        isLiked = cached?.iLike ?: fallbackIsLiked
+        isLiked = cached?.iLike ?: fallbackIsLiked,
+        canModerate = canModerate
     )
 
     private data class CommentLoadResult(
@@ -466,7 +494,8 @@ class UnifiedCommentDetailsViewModel @Inject constructor(
         val commentUrl: String = "",
         val status: CommentStatus = CommentStatus.ALL,
         val isLiked: Boolean = false,
-        val isReplyInProgress: Boolean = false
+        val isReplyInProgress: Boolean = false,
+        val canModerate: Boolean = false
     )
 }
 

WordPress/src/main/java/org/wordpress/android/ui/comments/unified/compose/CommentActionFooter.kt

@@ -38,8 +38,15 @@ import org.wordpress.android.ui.compose.theme.AppThemeM3
 /**
  * The row of comment actions pinned above the reply box: moderate (approve/unapprove/untrash),
  * spam, like and a "more" overflow menu (edit, trash, copy/share link, delete permanently).
- * Mirrors the legacy comment_action_footer layout: equal-width icon+label buttons, accent colour
- * at full opacity when a toggle is on, on-surface at medium opacity when off.
+ * Mirrors the legacy comment_action_footer layout: equal-width icon+label buttons in on-surface
+ * at medium emphasis. An enabled on toggle (approved or liked) is highlighted with the accent
+ * colour at full opacity; once disabled it dims to on-surface at the reduced disabled opacity, so
+ * a moderation action the user can't perform no longer shows a tappable-looking tint.
+ *
+ * When [canModerate] is false (the current user lacks the moderate_comments capability) the
+ * moderation controls — moderate, spam, edit, trash and delete permanently — stay visible but are
+ * disabled and dimmed, mirroring the legacy detail screen's per-capability gating. Like and the
+ * copy/share-link actions are unaffected; the reply box (rendered separately) also stays active.
  */
 @Composable
 @Suppress("LongParameterList")
@@ -48,6 +55,7 @@ fun CommentActionFooter(
     isLiked: Boolean,
     showLikeButton: Boolean,
     showCommentUrlActions: Boolean,
+    canModerate: Boolean,
     onModerateClick: () -> Unit,
     onSpamClick: () -> Unit,
     onLikeClick: () -> Unit,
@@ -59,23 +67,24 @@ fun CommentActionFooter(
     modifier: Modifier = Modifier
 ) {
     Row(modifier = modifier.fillMaxWidth()) {
-        val (moderateIconRes, moderateLabelRes, moderateIsOn) = when (status) {
-            APPROVED -> Triple(R.drawable.ic_checkmark_white_24dp, R.string.comment_status_approved, true)
-            TRASH -> Triple(R.drawable.ic_undo_white_24dp, R.string.mnu_comment_untrash, false)
-            else -> Triple(R.drawable.ic_checkmark_white_24dp, R.string.mnu_comment_approve, false)
+        val (moderateIconRes, moderateLabelRes) = when (status) {
+            APPROVED -> Pair(R.drawable.ic_checkmark_white_24dp, R.string.comment_status_approved)
+            TRASH -> Pair(R.drawable.ic_undo_white_24dp, R.string.mnu_comment_untrash)
+            else -> Pair(R.drawable.ic_checkmark_white_24dp, R.string.mnu_comment_approve)
         }
         ActionButton(
             iconRes = moderateIconRes,
             labelRes = moderateLabelRes,
-            isOn = moderateIsOn,
+            isOn = status == APPROVED,
+            enabled = canModerate,
             onClick = onModerateClick,
             modifier = Modifier.weight(1f)
         )
 
         ActionButton(
             iconRes = R.drawable.ic_spam_white_24dp,
             labelRes = if (status == SPAM) R.string.mnu_comment_unspam else R.string.mnu_comment_spam,
-            isOn = false,
+            enabled = canModerate,
             onClick = onSpamClick,
             modifier = Modifier.weight(1f)
         )
@@ -93,6 +102,7 @@ fun CommentActionFooter(
         MoreActionButton(
             status = status,
             showCommentUrlActions = showCommentUrlActions,
+            canModerate = canModerate,
             onEditClick = onEditClick,
             onTrashClick = onTrashClick,
             onCopyLinkClick = onCopyLinkClick,
@@ -108,6 +118,7 @@ fun CommentActionFooter(
 private fun MoreActionButton(
     status: CommentStatus,
     showCommentUrlActions: Boolean,
+    canModerate: Boolean,
     onEditClick: () -> Unit,
     onTrashClick: () -> Unit,
     onCopyLinkClick: () -> Unit,
@@ -117,10 +128,11 @@ private fun MoreActionButton(
 ) {
     var isMenuExpanded by remember { mutableStateOf(false) }
     Box(modifier = modifier) {
+        // The button itself stays enabled even without moderation rights so the copy/share-link
+        // items remain reachable; the moderation items inside are individually disabled instead.
         ActionButton(
             iconRes = R.drawable.ic_more_horiz_white_24dp,
             labelRes = R.string.more,
-            isOn = false,
             onClick = { isMenuExpanded = true },
             // Fill the Box (which carries this button's share of the row) so the icon centres in
             // its slot like the sibling buttons, instead of hugging the slot's start edge
@@ -131,17 +143,17 @@ private fun MoreActionButton(
             onDismissRequest = { isMenuExpanded = false }
         ) {
             val errorColor = MaterialTheme.colorScheme.error
-            MoreMenuItem(R.string.edit) {
+            MoreMenuItem(R.string.edit, enabled = canModerate) {
                 isMenuExpanded = false
                 onEditClick()
             }
             if (status == TRASH) {
-                MoreMenuItem(R.string.mnu_comment_untrash) {
+                MoreMenuItem(R.string.mnu_comment_untrash, enabled = canModerate) {
                     isMenuExpanded = false
                     onTrashClick()
                 }
             } else {
-                MoreMenuItem(R.string.mnu_comment_trash, color = errorColor) {
+                MoreMenuItem(R.string.mnu_comment_trash, color = errorColor, enabled = canModerate) {
                     isMenuExpanded = false
                     onTrashClick()
                 }
@@ -157,7 +169,7 @@ private fun MoreActionButton(
                 }
             }
             if (status == TRASH || status == SPAM) {
-                MoreMenuItem(R.string.mnu_comment_delete_permanently, color = errorColor) {
+                MoreMenuItem(R.string.mnu_comment_delete_permanently, color = errorColor, enabled = canModerate) {
                     isMenuExpanded = false
                     onDeletePermanentlyClick()
                 }
@@ -170,10 +182,14 @@ private fun MoreActionButton(
 private fun MoreMenuItem(
     @StringRes labelRes: Int,
     color: Color = Color.Unspecified,
+    enabled: Boolean = true,
     onClick: () -> Unit
 ) {
     DropdownMenuItem(
-        text = { Text(text = stringResource(labelRes), color = color) },
+        // Only apply the explicit colour (e.g. the destructive red) while enabled; when disabled,
+        // defer to the menu item's disabled content colour so it greys out instead of staying red.
+        text = { Text(text = stringResource(labelRes), color = if (enabled) color else Color.Unspecified) },
+        enabled = enabled,
         onClick = onClick
     )
 }
@@ -182,15 +198,23 @@ private fun MoreMenuItem(
 private fun ActionButton(
     @DrawableRes iconRes: Int,
     @StringRes labelRes: Int,
-    isOn: Boolean,
     onClick: () -> Unit,
-    modifier: Modifier = Modifier
+    modifier: Modifier = Modifier,
+    enabled: Boolean = true,
+    isOn: Boolean = false
 ) {
-    val color = if (isOn) MaterialTheme.colorScheme.secondary else MaterialTheme.colorScheme.onSurface
-    val alpha = if (isOn) 1f else MEDIUM_EMPHASIS_ALPHA
+    // An on toggle (approved or liked) is highlighted with the accent colour at full opacity, but
+    // only while it's actionable; once disabled it drops to on-surface at the reduced disabled
+    // opacity so a moderation action the user can't perform no longer shows a tappable-looking tint.
+    val color = if (isOn && enabled) MaterialTheme.colorScheme.secondary else MaterialTheme.colorScheme.onSurface
+    val alpha = when {
+        !enabled -> DISABLED_EMPHASIS_ALPHA
+        isOn -> 1f
+        else -> MEDIUM_EMPHASIS_ALPHA
+    }
     Column(
         modifier = modifier
-            .clickable(onClick = onClick)
+            .clickable(enabled = enabled, onClick = onClick)
             .padding(horizontal = 4.dp, vertical = 8.dp),
         horizontalAlignment = Alignment.CenterHorizontally
     ) {
@@ -210,9 +234,12 @@ private fun ActionButton(
     }
 }
 
-/** Matches material_emphasis_medium, used by the legacy footer for "off" action buttons. */
+/** Matches material_emphasis_medium, used by the footer for enabled "off" action buttons. */
 internal const val MEDIUM_EMPHASIS_ALPHA = 0.6f
 
+/** Material's disabled-content opacity, used to dim moderation buttons the user can't use. */
+private const val DISABLED_EMPHASIS_ALPHA = 0.38f
+
 @Preview(showBackground = true)
 @Composable
 private fun CommentActionFooterPreview() {
@@ -222,6 +249,7 @@ private fun CommentActionFooterPreview() {
             isLiked = true,
             showLikeButton = true,
             showCommentUrlActions = true,
+            canModerate = true,
             onModerateClick = {},
             onSpamClick = {},
             onLikeClick = {},

WordPress/src/main/java/org/wordpress/android/ui/comments/unified/compose/UnifiedCommentDetailsScreen.kt

@@ -104,6 +104,7 @@ fun UnifiedCommentDetailsScreen(
                     isLiked = uiState.isLiked,
                     showLikeButton = showLikeButton,
                     showCommentUrlActions = uiState.commentUrl.isNotEmpty(),
+                    canModerate = uiState.canModerate,
                     onModerateClick = actions.onModerateClick,
                     onSpamClick = actions.onSpamClick,
                     onLikeClick = actions.onLikeClick,
@@ -281,7 +282,8 @@ private fun UnifiedCommentDetailsScreenPreview() {
                 commentText = "This is a <b>great</b> post, thanks for sharing!",
                 postTitle = "My first post",
                 commentUrl = "https://example.com/post#comment-1",
-                status = UNAPPROVED
+                status = UNAPPROVED,
+                canModerate = true
             ),
             replyText = TextFieldValue(""),
             onReplyTextChange = {},

WordPress/src/main/java/org/wordpress/android/ui/commentsrs/CommentsRsListActivity.kt

@@ -42,6 +42,7 @@ class CommentsRsListActivity : BaseAppCompatActivity() {
         setContent {
             val tabStates by viewModel.tabStates.collectAsState()
             val selectedIds by viewModel.selectedIds.collectAsState()
+            val canModerate by viewModel.canModerate.collectAsState()
             val confirmation by viewModel.pendingConfirmation.collectAsState()
             val isSearchActive by viewModel.isSearchActive.collectAsState()
             val searchQuery by viewModel.searchQuery.collectAsState()
@@ -50,6 +51,7 @@ class CommentsRsListActivity : BaseAppCompatActivity() {
                 CommentsRsListScreen(
                     tabStates = tabStates,
                     selectedIds = selectedIds,
+                    canModerate = canModerate,
                     pendingConfirmation = confirmation,
                     isSearchActive = isSearchActive,
                     searchQuery = searchQuery,

WordPress/src/main/java/org/wordpress/android/ui/commentsrs/CommentsRsListUiState.kt

@@ -125,13 +125,17 @@ internal fun CommentsRsListTab.batchActions(): List<CommentsRsBatchAction> = whe
 }
 
 /**
- * Whether [this] action can act on a selection whose comments have [selectedStatuses]. Approve and
- * unapprove are disabled when they would be a no-op — nothing unapproved to approve, or nothing
- * approved to unapprove; every other action is always enabled.
+ * Whether [this] action can act on a selection whose comments have [selectedStatuses]. Every batch
+ * action requires [canModerate] (the moderate_comments capability) — without it they stay visible
+ * but disabled, mirroring the detail screen's footer. Approve and unapprove are additionally
+ * disabled when they would be a no-op — nothing unapproved to approve, or nothing approved to
+ * unapprove; every other action is enabled whenever the user can moderate.
  */
-internal fun CommentsRsBatchAction.isEnabledFor(selectedStatuses: Set<CommentStatus>): Boolean =
-    when (this) {
-        CommentsRsBatchAction.APPROVE -> CommentStatus.UNAPPROVED in selectedStatuses
-        CommentsRsBatchAction.UNAPPROVE -> CommentStatus.APPROVED in selectedStatuses
-        else -> true
-    }
+internal fun CommentsRsBatchAction.isEnabledFor(
+    selectedStatuses: Set<CommentStatus>,
+    canModerate: Boolean
+): Boolean = canModerate && when (this) {
+    CommentsRsBatchAction.APPROVE -> CommentStatus.UNAPPROVED in selectedStatuses
+    CommentsRsBatchAction.UNAPPROVE -> CommentStatus.APPROVED in selectedStatuses
+    else -> true
+}