FIX: prevents user to restore message deleted by staff (#22571)

It could only occur on message created by the user itself and deleted while the user was looking at the channel.

It more generally fix the trash service which was not correctly setting the author of the delete.

plugins/chat/spec/system/page_objects/chat/chat_channel.rb

@@ -120,6 +120,12 @@ module PageObjects
         find("[data-value='delete']").click
       end
 
+      def restore_message(message)
+        hover_message(message)
+        click_more_button
+        find("[data-value='restore']").click
+      end
+
       def open_edit_message(message)
         hover_message(message)
         click_more_button

plugins/chat/spec/system/page_objects/chat/components/message.rb

@@ -18,7 +18,16 @@ module PageObjects
         end
 
         def hover
-          message_by_id(message.id).hover
+          component.hover
+        end
+
+        def open_more_menu
+          hover
+          click_more_button
+        end
+
+        def expand
+          component.find(".chat-message-expand").click
         end
 
         def select(shift: false)
@@ -37,7 +46,7 @@ module PageObjects
             component.click(delay: 0.6)
             page.find(".chat-message-actions [data-id=\"select\"]").click
           else
-            component.hover
+            hover
             click_more_button
             page.find("[data-value='select']").click
           end

plugins/chat/spec/system/page_objects/chat/components/messages.rb

@@ -16,6 +16,22 @@ module PageObjects
           page.find(context)
         end
 
+        def has_action?(action, **args)
+          message = find(args)
+          message.open_more_menu
+          page.has_css?("[data-value='#{action}']")
+        end
+
+        def has_no_action?(action, **args)
+          message = find(args)
+          message.open_more_menu
+          page.has_no_css?("[data-value='#{action}']")
+        end
+
+        def expand(**args)
+          find(args).expand
+        end
+
         def select(args)
           find(args).select
         end

plugins/chat/spec/system/restore_message_spec.rb

@@ -0,0 +1,76 @@
+# frozen_string_literal: true
+
+RSpec.describe "Restore message", type: :system do
+  fab!(:admin_user) { Fabricate(:admin) }
+  fab!(:regular_user) { Fabricate(:user) }
+  fab!(:another_user) { Fabricate(:user) }
+  fab!(:channel_1) { Fabricate(:category_channel) }
+
+  let(:chat_page) { PageObjects::Pages::Chat.new }
+  let(:chat_channel_page) { PageObjects::Pages::ChatChannel.new }
+
+  before do
+    chat_system_bootstrap
+    channel_1.add(admin_user)
+    channel_1.add(regular_user)
+    channel_1.add(another_user)
+  end
+
+  context "when user deletes its own message" do
+    fab!(:message_1) { Fabricate(:chat_message, chat_channel: channel_1, user: regular_user) }
+
+    it "can be restored by the owner" do
+      sign_in(regular_user)
+      chat_page.visit_channel(channel_1)
+
+      chat_channel_page.delete_message(message_1)
+
+      expect(chat_channel_page.messages).to have_deleted_message(message_1, count: 1)
+      expect(chat_channel_page.messages).to have_action("restore", id: message_1.id)
+    end
+
+    it "can't be restored by another user" do
+      using_session(:another_user) do
+        sign_in(another_user)
+        chat_page.visit_channel(channel_1)
+      end
+
+      using_session(:regular_user) do |session|
+        sign_in(regular_user)
+        chat_page.visit_channel(channel_1)
+        chat_channel_page.delete_message(message_1)
+        session.quit
+      end
+
+      using_session(:another_user) do |session|
+        expect(chat_channel_page.messages).to have_no_message(id: message_1.id)
+        session.quit
+      end
+    end
+  end
+
+  context "when staff deletes user message" do
+    fab!(:message_1) { Fabricate(:chat_message, chat_channel: channel_1, user: regular_user) }
+
+    it "can't be restored by owner" do
+      using_session(:regular_user) do
+        sign_in(regular_user)
+        chat_page.visit_channel(channel_1)
+      end
+
+      using_session(:admin_user) do |session|
+        sign_in(admin_user)
+        chat_page.visit_channel(channel_1)
+        chat_channel_page.delete_message(message_1)
+        session.quit
+      end
+
+      using_session(:regular_user) do |session|
+        expect(chat_channel_page.messages).to have_deleted_message(message_1, count: 1)
+        chat_channel_page.messages.expand(id: message_1.id)
+        expect(chat_channel_page.messages).to have_no_action("restore", id: message_1.id)
+        session.quit
+      end
+    end
+  end
+end