Allow group members to access group drafts

Closes #843

Signed-off-by: Thomas Citharel <tcit@tcit.fr>

lib/federation/activity_pub/transmogrifier.ex

@@ -391,12 +391,15 @@ defmodule Mobilizon.Federation.ActivityPub.Transmogrifier do
         } = params
       )
       when object_type in ["Person", "Group", "Application", "Service", "Organization"] do
-    with {:ok, %Actor{suspended: false} = old_actor} <-
+    with author_url <- Utils.get_actor(params),
+         {:ok, %Actor{suspended: false} = author} <-
+           ActivityPubActor.get_or_fetch_actor_by_url(author_url),
+         {:ok, %Actor{suspended: false} = old_actor} <-
            ActivityPubActor.get_or_fetch_actor_by_url(object["id"]),
          object_data <-
            object |> Converter.Actor.as_to_model_data(),
          {:ok, %Activity{} = activity, %Actor{} = new_actor} <-
-           Actions.Update.update(old_actor, object_data, false) do
+           Actions.Update.update(old_actor, object_data, false, %{updater_actor: author}) do
       {:ok, activity, new_actor}
     else
       e ->

lib/federation/activity_pub/types/actors.ex

@@ -43,18 +43,22 @@ defmodule Mobilizon.Federation.ActivityPub.Types.Actors do
   @spec update(Actor.t(), map, map) ::
           {:ok, Actor.t(), ActivityStream.t()} | {:error, Ecto.Changeset.t()}
   def update(%Actor{} = old_actor, args, additional) do
+    updater_actor = Map.get(args, :updater_actor) || Map.get(additional, :updater_actor)
+
     case Actors.update_actor(old_actor, args) do
       {:ok, %Actor{} = new_actor} ->
         GroupActivity.insert_activity(new_actor,
           subject: "group_updated",
           old_group: old_actor,
-          updater_actor: Map.get(args, :updater_actor)
+          updater_actor: updater_actor
         )
 
         actor_as_data = Convertible.model_to_as(new_actor)
         Cachex.del(:activity_pub, "actor_#{new_actor.preferred_username}")
         audience = Audience.get_audience(new_actor)
-        additional = Map.merge(additional, %{"actor" => old_actor.url})
+
+        additional = Map.merge(additional, %{"actor" => (updater_actor || old_actor).url})
+
         update_data = make_update_data(actor_as_data, Map.merge(audience, additional))
         {:ok, new_actor, update_data}
 

lib/federation/activity_pub/types/events.ex

@@ -129,7 +129,7 @@ defmodule Mobilizon.Federation.ActivityPub.Types.Events do
   @spec permissions(Event.t()) :: Permission.t()
   def permissions(%Event{draft: draft, attributed_to_id: _attributed_to_id}) do
     %Permission{
-      access: if(draft, do: nil, else: :member),
+      access: if(draft, do: :moderator, else: :member),
       create: :moderator,
       update: :moderator,
       delete: :moderator