Feature Spec: Article Comments (create/list/delete + authorization) test coverage

[devin-ai-integration]

Feature Spec: Article Comments

As a registered user, I can comment on articles, read an article's comments, and delete my own comments. Covers the REST comment endpoints, authorization rules, and comment read-model shape.

Behavior / Acceptance Criteria

Add a comment (REST POST /articles/{slug}/comments)

• AC1: An authenticated user posting a non-empty comment on an existing article receives 200 and the response comment.body matches the input.
• AC2: The response includes comment.author (username, bio, image, following) for the commenting user.
• AC3: Posting a comment with an empty/blank body returns 422 with a validation error.
• AC4: An unauthenticated request returns 401.
• AC5: Commenting on a non-existent article returns 404.

List comments (REST GET /articles/{slug}/comments)

• AC6: Requesting comments for an existing article returns 200 with a comments array in creation order.
• AC7: For an authenticated viewer, each comment's author.following reflects the viewer's follow state.
• AC8: An anonymous viewer can list comments and sees author.following=false.
• AC9: Listing comments for a non-existent article returns 404.

Delete a comment (REST DELETE /articles/{slug}/comments/{id})

• AC10: The comment's author deleting their own comment receives 204/200 and the comment is removed.
• AC11: A user attempting to delete another user's comment receives 403.
• AC12: An unauthenticated delete request returns 401.
• AC13: Deleting a non-existent comment id returns 404.

Read-model / persistence

• AC14: The comment read model returns the correct author profile and creation timestamp per comment.

Notes

• Follow existing per-tier test conventions in the repo.
• Authorization: only the comment author may delete their comment.