🐛 Fixed hidden comments still appearing

refs https://linear.app/ghost/issue/ONC-469

Hidden comments were not being purged from the cache, which resulted
in stale data being served, and hidden comments being visible.

ghost/core/core/server/api/endpoints/comments.js

@@ -1,5 +1,17 @@
 const models = require('../../models');
 
+function handleCacheHeaders(model, frame) {
+    if (model) {
+        const postId = model.get('post_id');
+        const parentId = model.get('parent_id');
+        const pathsToInvalidate = [
+            postId ? `/api/members/comments/post/${postId}/` : null,
+            parentId ? `/api/members/comments/${parentId}/replies/` : null
+        ].filter(path => path !== null);
+        frame.setHeader('X-Cache-Invalidate', pathsToInvalidate.join(', '));
+    }
+}
+
 /** @type {import('@tryghost/api-framework').Controller} */
 const controller = {
     docName: 'comments',
@@ -19,11 +31,15 @@ const controller = {
             }
         },
         permissions: true,
-        query(frame) {
+        async query(frame) {
-            return models.Comment.edit({
+            const result = await models.Comment.edit({
                 id: frame.data.comments[0].id,
                 status: frame.data.comments[0].status
             }, frame.options);
+
+            handleCacheHeaders(result, frame);
+
+            return result;
         }
     }
 };

ghost/core/test/e2e-api/admin/comments.test.js

@@ -0,0 +1,87 @@
+const assert = require('assert/strict');
+const {
+    agentProvider,
+    fixtureManager,
+    mockManager
+} = require('../../utils/e2e-framework');
+
+describe('Comments API', function () {
+    let adminApi;
+    let membersApi;
+
+    before(async function () {
+        const agents = await agentProvider.getAgentsForMembers();
+        adminApi = agents.adminAgent;
+        membersApi = agents.membersAgent;
+        await fixtureManager.init('users', 'posts', 'members', 'comments');
+        await adminApi.loginAsOwner();
+        mockManager.mockSetting('comments_enabled', 'all');
+    });
+
+    after(function () {
+        mockManager.restore();
+    });
+
+    describe('Hide', function () {
+        it('Can hide comments', async function () {
+            const commentToHide = fixtureManager.get('comments', 0);
+
+            const {body: {comments: [initialState]}} = await membersApi.get(`/api/comments/${commentToHide.id}/`);
+
+            assert.equal(initialState.status, 'published');
+
+            const res = await adminApi.put(`comments/${commentToHide.id}/`).body({
+                comments: [{
+                    id: commentToHide.id,
+                    status: 'hidden'
+                }]
+            });
+
+            assert.equal(res.headers['x-cache-invalidate'], '/api/members/comments/post/618ba1ffbe2896088840a6df/');
+
+            const {body: {comments: [afterHiding]}} = await membersApi.get(`/api/comments/${commentToHide.id}/`);
+
+            assert.equal(afterHiding.status, 'hidden');
+
+            // Cleanup
+            await adminApi.put(`comments/${commentToHide.id}/`).body({
+                comments: [{
+                    id: commentToHide.id,
+                    status: 'published'
+                }]
+            });
+        });
+
+        it('Can hide replies', async function () {
+            const commentToHide = fixtureManager.get('comments', 1);
+
+            const {body: {comments: [initialState]}} = await membersApi.get(`/api/comments/${commentToHide.id}/`);
+
+            assert.equal(initialState.status, 'published');
+
+            const res = await adminApi.put(`comments/${commentToHide.id}/`).body({
+                comments: [{
+                    id: commentToHide.id,
+                    status: 'hidden'
+                }]
+            });
+
+            assert.equal(
+                res.headers['x-cache-invalidate'],
+                '/api/members/comments/post/618ba1ffbe2896088840a6df/, /api/members/comments/6195c6a1e792de832cd08144/replies/'
+            );
+
+            const {body: {comments: [afterHiding]}} = await membersApi.get(`/api/comments/${commentToHide.id}/`);
+
+            assert.equal(afterHiding.status, 'hidden');
+
+            // Cleanup
+            await adminApi.put(`comments/${commentToHide.id}/`).body({
+                comments: [{
+                    id: commentToHide.id,
+                    status: 'published'
+                }]
+            });
+        });
+    });
+});