Merge remote-tracking branch 'upstream/pull/4251'

app/controllers/api/changesets_controller.rb

@@ -6,6 +6,7 @@ module Api
 
     before_action :check_api_writable, :only => [:create, :update, :upload, :subscribe, :unsubscribe]
     before_action :check_api_readable, :except => [:create, :update, :upload, :download, :query, :subscribe, :unsubscribe]
+    before_action :setup_user_auth, :only => [:show]
     before_action :authorize, :only => [:create, :update, :upload, :close, :subscribe, :unsubscribe]
 
     authorize_resource
@@ -24,7 +25,11 @@ module Api
     # return anything about the nodes, ways and relations in the changeset.
     def show
       @changeset = Changeset.find(params[:id])
-      @include_discussion = params[:include_discussion].presence
+      if params[:include_discussion].presence
+        @comments = @changeset.comments
+        @comments = @comments.unscope(:where => :visible) if params[:show_hidden_comments].presence && can?(:restore, ChangesetComment)
+        @comments = @comments.includes(:author)
+      end
       render "changeset"
 
       respond_to do |format|

app/views/api/changesets/_changeset.json.jbuilder

@@ -21,9 +21,10 @@ end
 
 json.tags changeset.tags unless changeset.tags.empty?
 
-if @include_discussion
-  json.comments(changeset.comments) do |comment|
+if @comments
+  json.comments(@comments) do |comment|
     json.id comment.id
+    json.visible comment.visible
     json.date comment.created_at.xmlschema
     if comment.author.data_public?
       json.uid comment.author.id

app/views/api/changesets/_changeset.xml.builder

@@ -24,12 +24,13 @@ xml.changeset(attrs) do |changeset_xml_node|
 
   # include discussion if requested
 
-  if @include_discussion
+  if @comments
     changeset_xml_node.discussion do |discussion_xml_node|
-      changeset.comments.includes(:author).each do |comment|
+      @comments.each do |comment|
         cattrs = {
           "id" => comment.id,
-          "date" => comment.created_at.xmlschema
+          "date" => comment.created_at.xmlschema,
+          "visible" => comment.visible
         }
         if comment.author.data_public?
           cattrs["uid"] = comment.author.id