[Bug]: Contents of removed comments are no longer visible via API for moderators and admins

[Nothing4You]

Requirements

• Is this a bug report? For questions or discussions use https://lemmy.ml/c/lemmy_support
• Did you check to see if this issue already exists?
• Is this only a single bug? Do not put multiple bugs in one issue.
• Do you agree to follow the rules in our Code of Conduct?
• Is this a backend issue? Use the lemmy-ui repo for UI / frontend issues.

Summary

#4503 removed contents of removed/deleted comments from API responses.

This is generally a big improvement, as it will cover a lot of situations where comment contents should no longer be visible, like unintentional information disclosure, removal of offensive content, or otherwise redacted information.

For some people however it should be possible to see removed/deleted comment contents.
As there are several valid use cases for this, I consider this a regression.

• Creators should be able to see contents regardless of whether content was removed or deleted. This allows easy access to save content elsewhere or review which comment they want to restore in case of deletion.
• Community moderators should be able to see content of removed comments in communities they moderate. This is an important feature to be able to review contents of comments before deciding to restore them. If they can't see content of removed comments in their community, they will generally have to restore a comment only to evaluate whether it should stay removed or should get restored.
• Site admins should be able to see contents of all removed comments for moderation purposes, e.g. for evaluating whether a person should be site banned. Additionally, I consider it a worthy feature for site admins to be able to see contents of deleted comments, but I can see this having a bit more privacy impact.

I believe visibility of deleted comment contents for site admins is the only request that is debatable, and depending on the instance it might be desirable to not expose this information to all site admins and restrict it to people with DB access.
In that case I believe this should be configurable through the configuration file to either allow or not allow access to contents.
After a couple days there is a scheduled task permanently removing contents of deleted comments anyway, so this will not expose very old comment contents.

For completeness, I want to mention that reports already contain a copy of the content at the time of the report, so this does not currently allow people to evade the report system by deleting their comment before it receives moderator attention.

Steps to Reproduce

1. Delete or remove a comment
2. Check the API response, e.g. for /api/v3/user

Technical Details

N/A

Version

0.19.4-beta6

Lemmy Instance URL

voyager.lemmy.ml

[dessalines]

Creators should be able to see contents regardless of whether content was removed or deleted.

Torn about this one, mainly because of the extra complication required in UIs just to view this data, when you can already easily click restore / undelete, and it'd be much faster.

For the other two concerns: We've added an API request / dropdown for posts and comments, where you can see the moderation history of an item. So admins / mods can view removed content there, and see the entire history of it too.

[Nothing4You]

Creators can't restore removed comments, only deleted ones.

Restoring deleted comments may expose content that they intended to keep removed for everyone, even if just temporarily.

For moderation history, that is still lacking imo. Based on what's available in lemmy-ui, it seems that this is just a modlog excerpt, but modlog is not populated with every individual post/comment that was removed as a result of banning a user with content removal.
Arguably, this could also be considered as a feature request for modlog to include all those entries as well, which with per-post/comment modlog view is probably even more important now.

I haven't looked at the API yet, wouldn't this require a modlog API call for each individual comment?
Let's say I am an instance admin looking through a users profile. This profile shows 20 comments, which are all removed, and I want to review if these comments are just something the community mods don't want in their community or the user should be banned entirely, e.g. for harassment or trolling.
Now for a client to display me this content, 20 additional requests would have to be made to get modlog for all these comments, just to obtain the original content.
Granted, an admin or client could just look at the target users modlog instead of per item modlogs to make their decision, but then they might have to go through a bunch of pages of modlog, which may or may not have duplicate events concerning the same item, content displayed out of creation order and isn't unlikely to require pagination to ensure getting all relevant modlog entries.

Dealing with recent trolls, often content is removed by community mods prior to admins being made aware, so it is crucial to have easy access to this overview to prevent them from expanding to other communities.

[dessalines]

modlog is not populated with every individual post/comment that was removed as a result of banning a user with content removal.

Could you create an issue for that? I agree each comment / post removed should have a modlog entry.

Let's say I am an instance admin looking through a users profile. This profile shows 20 comments, which are all removed, and I want to review if these comments are just something the community mods don't want in their community or the user should be banned entirely, e.g. for harassment or trolling.

The modlog already supports filtering by user, eg https://lemmy.ml/modlog?page=1&userId=7904

So we'd just need to add either a dropdown for lemmy-ui to navigate there, either from the post / comment dropdowns, or their profile page.

Restoring deleted comments may expose content that they intended to keep removed for everyone, even if just temporarily.

This would still need a clean UI flow, for: you deleted your comment but want to see it again, but don't want to restore it. The temporarily making it public / private to me seems pretty minor, since it was public before you deleted it anyway.

[Nothing4You]

Could you create an issue for that

Done: #4699

The modlog already supports filtering by user

This is only part of the answer though. Frequently I want to see not only present or only removed comments, but the timeline of comments created on a user's profile.
In a comment thread, I frequently want to see context for other comments, e.g. to determine whether an inflammatory comment was intentionally baited.

The screenshots below are not vanilla lemmy-ui, but they demonstrate the client capabilities.
I'm currently using this with a hacky userscript.

0.19.3 user profile

0.19.3 comment thread

0.19.4 user profile

0.19.4 comment thread

[dessalines]

0.19.3 was essentially bugged behavior... and it leaked not only removed, but deleted content also. I'm still torn on whether to include this special case for admins only, or just rely on the existing modlog.

but the timeline of comments created on a user's profile.

That is exactly what the modlog filtered by user shows.

I'd need other devs to chime in on this one.