From 702abaf947b4dfd62a9971e9c6ca73f486b631db Mon Sep 17 00:00:00 2001
From: Kevin Thomas <kevin@mytechnotalent.com>
Date: Sun, 1 Nov 2026 10:02:33 -0500
Subject: [PATCH 1/2] Add functionality to edit and delete user comments

---
 app/controllers/comment.py          | 123 +++++++++++++++++++++++++++-
 app/models/comment.py               |  80 +++++++++++++++++-
 templates/crackme/read.html         |  59 ++++++++++++-
 tests/test_comments_and_crackmes.py | 103 +++++++++++++++++++++++
 tests/test_models_extended.py       |  17 ++++
 5 files changed, 376 insertions(+), 6 deletions(-)

diff --git a/app/controllers/comment.py b/app/controllers/comment.py
index 0e93576..cc0fafa 100644
--- a/app/controllers/comment.py
+++ b/app/controllers/comment.py
@@ -7,10 +7,14 @@
 from html import escape as html_escape
 from flask import Blueprint, request, redirect, flash, session, render_template
 import bleach
-from app.models.comment import comment_create, comment_by_id, comment_set_spoiler, get_thread_participants
+from app.models.comment import (
+    comment_create, comment_by_id, comment_set_spoiler,
+    comment_update, comment_delete, get_thread_participants
+)
 from app.models.solution import get_solution_authors
 from app.models.crackme import (
-    crackme_by_hexid, crackme_increment_comments, crackme_is_auto_validated
+    crackme_by_hexid, crackme_increment_comments, crackme_decrement_comments,
+    crackme_is_auto_validated
 )
 from app.models.notification import notification_add
 from app.models.errors import ErrNoResult
@@ -276,3 +280,118 @@ def mark_spoiler_by_token(comment_id, token):
         return render_template('comment/spoiler_marked.html',
                              success=False,
                              error="Comment not found.")
+
+
+@comment_bp.route('/comment/<comment_id>/edit', methods=['POST'])
+@login_required
+@limit("30 per hour", key_func=lambda: session.get('name'))
+def edit_comment(comment_id):
+    """Edit a comment.
+
+    Permissions:
+    - Comment author: can edit their own comment
+    """
+    username = session.get('name')
+
+    try:
+        comment = comment_by_id(comment_id)
+    except ErrNoResult:
+        flash('Comment not found.', FLASH_ERROR)
+        return redirect('/')
+
+    crackme_hexid = comment.get('crackmehexid')
+    comment_author = comment.get('author')
+
+    # Only comment author can edit
+    if comment_author != username:
+        flash('You can only edit your own comments.', FLASH_ERROR)
+        return redirect(f'/crackme/{crackme_hexid}' if crackme_hexid else '/')
+
+    # Validate required fields
+    is_valid, missing = validate_required(request.form, ['comment'])
+    if not is_valid:
+        flash(f'Field missing: {missing}', FLASH_ERROR)
+        return redirect(f'/crackme/{crackme_hexid}' if crackme_hexid else '/')
+
+    comment_text = bleach.clean(request.form.get('comment', ''))
+    if not comment_text.strip():
+        flash('Comment cannot be empty.', FLASH_ERROR)
+        return redirect(f'/crackme/{crackme_hexid}' if crackme_hexid else '/')
+
+    old_content = comment.get('info', '')
+
+    try:
+        comment_update(comment_id, comment_text)
+    except Exception as e:
+        print(f"Error updating comment: {e}")
+        flash('Failed to update comment. Please try again later.', FLASH_ERROR)
+        return redirect(f'/crackme/{crackme_hexid}' if crackme_hexid else '/')
+
+    # Handle any new @mentions added during editing
+    try:
+        old_mentions = parse_mentions(old_content)
+        new_mentions = parse_mentions(comment_text) - old_mentions
+        if new_mentions and crackme_hexid:
+            crackme = crackme_by_hexid(crackme_hexid)
+            crackme_author = crackme.get('author')
+            crackme_name = crackme['name']
+
+            thread_participants = get_thread_participants(crackme_hexid)
+            solution_authors = get_solution_authors(crackme_hexid)
+            valid_targets = thread_participants | solution_authors | {crackme_author}
+
+            for mentioned_user in new_mentions:
+                if mentioned_user == username:
+                    continue
+                if mentioned_user in valid_targets:
+                    notification_add(
+                        mentioned_user,
+                        f"You were mentioned by <a href=\"/user/{html_escape(username)}\">{html_escape(username)}</a> in a comment on '<a href=\"/crackme/{crackme_hexid}\">{html_escape(crackme_name)}</a>'"
+                    )
+    except Exception as e:
+        print(f"Mention notification error on edit: {e}")
+
+    flash('Comment updated!', FLASH_SUCCESS)
+    return redirect(f'/crackme/{crackme_hexid}' if crackme_hexid else '/')
+
+
+@comment_bp.route('/comment/<comment_id>/delete', methods=['POST'])
+@login_required
+def delete_comment(comment_id):
+    """Delete a comment.
+
+    Permissions:
+    - Comment author: can delete their own comment
+    """
+    username = session.get('name')
+
+    try:
+        comment = comment_by_id(comment_id)
+    except ErrNoResult:
+        flash('Comment not found.', FLASH_ERROR)
+        return redirect('/')
+
+    crackme_hexid = comment.get('crackmehexid')
+    comment_author = comment.get('author')
+
+    # Only comment author can delete
+    if comment_author != username:
+        flash('You can only delete your own comments.', FLASH_ERROR)
+        return redirect(f'/crackme/{crackme_hexid}' if crackme_hexid else '/')
+
+    try:
+        comment_delete(comment_id)
+    except Exception as e:
+        print(f"Error deleting comment: {e}")
+        flash('Failed to delete comment. Please try again later.', FLASH_ERROR)
+        return redirect(f'/crackme/{crackme_hexid}' if crackme_hexid else '/')
+
+    # Decrement comment count on crackme
+    if crackme_hexid:
+        try:
+            crackme_decrement_comments(crackme_hexid)
+        except Exception as e:
+            print(f"Failed to decrement comment count: {e}")
+
+    flash('Comment deleted.', FLASH_SUCCESS)
+    return redirect(f'/crackme/{crackme_hexid}' if crackme_hexid else '/')
diff --git a/app/models/comment.py b/app/models/comment.py
index df8bf90..3234844 100644
--- a/app/models/comment.py
+++ b/app/models/comment.py
@@ -105,7 +105,10 @@ def comment_by_id(comment_id):
     collection = get_collection('comment')
 
     if isinstance(comment_id, str):
-        comment_id = ObjectId(comment_id)
+        try:
+            comment_id = ObjectId(comment_id)
+        except Exception:
+            raise ErrNoResult("Comment not found")
 
     comment = collection.find_one({'_id': comment_id})
     if not comment:
@@ -154,7 +157,10 @@ def comment_set_spoiler(comment_id, is_spoiler):
     collection = get_collection('comment')
 
     if isinstance(comment_id, str):
-        comment_id = ObjectId(comment_id)
+        try:
+            comment_id = ObjectId(comment_id)
+        except Exception:
+            raise ErrNoResult("Comment not found")
 
     result = collection.find_one_and_update(
         {'_id': comment_id},
@@ -166,3 +172,73 @@ def comment_set_spoiler(comment_id, is_spoiler):
         raise ErrNoResult("Comment not found")
 
     return result
+
+
+def comment_update(comment_id, content):
+    """Update a comment's content.
+
+    Args:
+        comment_id: The comment's ObjectId (string or ObjectId)
+        content: The new comment content
+
+    Returns:
+        Updated comment document
+
+    Raises:
+        ErrNoResult: If comment not found
+    """
+    if not check_connection():
+        raise ErrUnavailable("Database is unavailable")
+
+    collection = get_collection('comment')
+
+    if isinstance(comment_id, str):
+        try:
+            comment_id = ObjectId(comment_id)
+        except Exception:
+            raise ErrNoResult("Comment not found")
+
+    result = collection.find_one_and_update(
+        {'_id': comment_id},
+        {'$set': {
+            'info': content,
+            'edited': True,
+            'updated_at': datetime.utcnow()
+        }},
+        return_document=ReturnDocument.AFTER
+    )
+
+    if not result:
+        raise ErrNoResult("Comment not found")
+
+    return result
+
+
+def comment_delete(comment_id):
+    """Delete a comment by its ID.
+
+    Args:
+        comment_id: The comment's ObjectId (string or ObjectId)
+
+    Returns:
+        Deleted comment document
+
+    Raises:
+        ErrNoResult: If comment not found
+    """
+    if not check_connection():
+        raise ErrUnavailable("Database is unavailable")
+
+    collection = get_collection('comment')
+
+    if isinstance(comment_id, str):
+        try:
+            comment_id = ObjectId(comment_id)
+        except Exception:
+            raise ErrNoResult("Comment not found")
+
+    comment = collection.find_one_and_delete({'_id': comment_id})
+    if not comment:
+        raise ErrNoResult("Comment not found")
+
+    return comment
diff --git a/templates/crackme/read.html b/templates/crackme/read.html
index 0464f7b..010e0f4 100644
--- a/templates/crackme/read.html
+++ b/templates/crackme/read.html
@@ -43,6 +43,17 @@
         }
     }
 
+    function openEditCommentModal(commentId) {
+        var raw = document.getElementById('comment-raw-' + commentId);
+        var textarea = document.getElementById('edit-comment-text');
+        var form = document.getElementById('form-edit-comment');
+        if (raw && textarea && form) {
+            textarea.value = raw.value;
+            form.action = '/comment/' + commentId + '/edit';
+            openModal('modal-edit-comment');
+        }
+    }
+
     function closeModal() {
         document.querySelectorAll('.modal.active').forEach(function(m) {
             m.classList.remove('active');
@@ -320,8 +331,29 @@ <h3><a href="/user/{{ username }}">{{ username }}</a>'s {{ name }}</h3>
             {% endif %}
             {% for comment in comments %}
             <div style="margin-bottom: 1em;">
-                {% if usersess == username or (usersess == comment.author and not comment.spoiler) %}<form action="/comment/{{ comment._id }}/spoiler" method="post" style="display: inline; float: right;"><input type="hidden" name="csrf_token" value="{{ csrf_token() }}"><button type="submit" class="btn btn-link btn-sm" title="{{ 'Remove spoiler mark' if comment.spoiler else 'Mark as spoiler' }}" style="padding: 0;{% if comment.spoiler %} color: #e85600;{% else %} opacity: 0.4;{% endif %}"><i class="icon icon-flag"></i></button></form>{% endif %}
-                <a href="/user/{{ comment.author }}">{{ comment.author }}</a> on {{ comment.created_at|PRETTYTIME }}:
+                <div style="float: right; display: flex; gap: 8px; align-items: center;">
+                    {% if usersess == comment.author %}
+                    <button type="button" class="btn btn-link btn-sm" title="Edit comment" onclick="openEditCommentModal('{{ comment._id }}')" style="padding: 0; opacity: 0.5;">
+                        <i class="icon icon-edit"></i>
+                    </button>
+                    <form action="/comment/{{ comment._id }}/delete" method="post" style="display: inline; margin: 0;" onsubmit="return confirm('Are you sure you want to delete this comment?');">
+                        <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
+                        <button type="submit" class="btn btn-link btn-sm text-error" title="Delete comment" style="padding: 0; opacity: 0.5;">
+                            <i class="icon icon-delete"></i>
+                        </button>
+                    </form>
+                    {% endif %}
+                    {% if usersess == username or (usersess == comment.author and not comment.spoiler) %}
+                    <form action="/comment/{{ comment._id }}/spoiler" method="post" style="display: inline; margin: 0;">
+                        <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
+                        <button type="submit" class="btn btn-link btn-sm" title="{{ 'Remove spoiler mark' if comment.spoiler else 'Mark as spoiler' }}" style="padding: 0;{% if comment.spoiler %} color: #e85600;{% else %} opacity: 0.4;{% endif %}">
+                            <i class="icon icon-flag"></i>
+                        </button>
+                    </form>
+                    {% endif %}
+                </div>
+                <textarea id="comment-raw-{{ comment._id }}" style="display: none;">{{ comment.info }}</textarea>
+                <a href="/user/{{ comment.author }}">{{ comment.author }}</a> on {{ comment.created_at|PRETTYTIME }}{% if comment.edited or comment.updated_at %} <span class="text-gray" style="font-size: 0.85em;" title="Edited{% if comment.updated_at %} on {{ comment.updated_at|PRETTYTIME }}{% endif %}">(edited)</span>{% endif %}:
                 {% if comment.spoiler %}
                 <span id="spoiler-hidden-{{ comment._id }}" class="spoiler-hidden" onclick="revealSpoiler('{{ comment._id }}')">[Click to reveal]</span><span id="spoiler-content-{{ comment._id }}" style="display: none; white-space: pre-line">{{ comment.info|render_mentions }}</span>{% else %}<span style="white-space: pre-line">{{ comment.info|render_mentions }}</span>{% endif %}
             </div>
@@ -386,6 +418,29 @@ <h3><a href="/user/{{ username }}">{{ username }}</a>'s {{ name }}</h3>
     </div>
     {% endif %}
 
+    {% if not auto_validation %}
+    <div class="modal" id="modal-edit-comment">
+        <a href="#" onclick="closeModal(); return false;" class="modal-overlay" aria-label="Close"></a>
+        <div class="modal-container">
+            <div class="modal-header">
+                <a href="#" onclick="closeModal(); return false;" class="btn btn-clear float-right" aria-label="Close"></a>
+                <div class="modal-title h5">Edit comment</div>
+            </div>
+            <div class="modal-body">
+                <div class="content">
+                    <form id="form-edit-comment" action="" method="post">
+                        <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
+                        <div style="position: relative;">
+                            <textarea name="comment" id="edit-comment-text" placeholder="Edit your comment..." style="width: 100%;" rows="5"></textarea>
+                        </div>
+                        <input type="submit" class="btn active float-right" value="Save changes" style="margin-top: 10px;">
+                    </form>
+                </div>
+            </div>
+        </div>
+    </div>
+    {% endif %}
+
     {% if not auto_validation %}
     <div class="modal" id="rate-diff">
         <a href="#" onclick="closeModal(); return false;" class="modal-overlay" aria-label="Close"></a>
diff --git a/tests/test_comments_and_crackmes.py b/tests/test_comments_and_crackmes.py
index 710edf3..f648674 100644
--- a/tests/test_comments_and_crackmes.py
+++ b/tests/test_comments_and_crackmes.py
@@ -117,3 +117,106 @@ def test_owner_can_edit_crackme_but_other_user_cannot(
     updated = db.crackme.find_one({'_id': sample_crackme['_id']})
     assert updated['info'] == 'Updated information'
     assert updated['lang'] == 'Rust'
+
+
+def test_comment_author_can_delete_own_comment(
+        bob_client, db, sample_crackme, bob):
+    from app.models.comment import comment_create
+    from app.models.crackme import crackme_increment_comments
+
+    comment = comment_create('To be deleted', 'bob', sample_crackme['hexid'])
+    crackme_increment_comments(sample_crackme['hexid'])
+
+    assert db.crackme.find_one({'_id': sample_crackme['_id']})['nbcomments'] == 1
+
+    response = bob_client.post(f"/comment/{comment['_id']}/delete")
+    assert response.status_code == 302
+    assert db.comment.find_one({'_id': comment['_id']}) is None
+    assert db.crackme.find_one({'_id': sample_crackme['_id']})['nbcomments'] == 0
+
+
+def test_other_user_cannot_delete_comment(
+        alice_client, db, sample_crackme, bob):
+    from app.models.comment import comment_create
+    from app.models.crackme import crackme_increment_comments
+
+    comment = comment_create('Bob comment', 'bob', sample_crackme['hexid'])
+    crackme_increment_comments(sample_crackme['hexid'])
+
+    response = alice_client.post(f"/comment/{comment['_id']}/delete")
+    assert response.status_code == 302
+    assert db.comment.find_one({'_id': comment['_id']}) is not None
+    assert db.crackme.find_one({'_id': sample_crackme['_id']})['nbcomments'] == 1
+
+
+def test_comment_author_can_edit_own_comment(
+        bob_client, db, sample_crackme, bob):
+    from app.models.comment import comment_create
+
+    comment = comment_create('Original comment text', 'bob', sample_crackme['hexid'])
+
+    response = bob_client.post(
+        f"/comment/{comment['_id']}/edit",
+        data={'comment': 'Updated comment text'}
+    )
+    assert response.status_code == 302
+    updated = db.comment.find_one({'_id': comment['_id']})
+    assert updated['info'] == 'Updated comment text'
+    assert updated.get('edited') is True
+    assert updated.get('updated_at') is not None
+
+
+def test_other_user_cannot_edit_comment(
+        alice_client, db, sample_crackme, bob):
+    from app.models.comment import comment_create
+
+    comment = comment_create('Bob original', 'bob', sample_crackme['hexid'])
+
+    response = alice_client.post(
+        f"/comment/{comment['_id']}/edit",
+        data={'comment': 'Alice tampering'}
+    )
+    assert response.status_code == 302
+    unchanged = db.comment.find_one({'_id': comment['_id']})
+    assert unchanged['info'] == 'Bob original'
+
+
+def test_comment_edit_empty_text_rejected(
+        bob_client, db, sample_crackme, bob):
+    from app.models.comment import comment_create
+
+    comment = comment_create('Valid text', 'bob', sample_crackme['hexid'])
+
+    response = bob_client.post(
+        f"/comment/{comment['_id']}/edit",
+        data={'comment': '   '}
+    )
+    assert response.status_code == 302
+    unchanged = db.comment.find_one({'_id': comment['_id']})
+    assert unchanged['info'] == 'Valid text'
+
+
+def test_comment_edit_notifies_new_mentions(
+        alice_client, bob_client, db, sample_crackme, bob):
+    from app.models.comment import comment_create
+
+    # Alice participates in thread
+    comment_create('Alice here', 'alice', sample_crackme['hexid'])
+    db.notifications.delete_many({})
+
+    # Bob creates comment without mention
+    comment = comment_create('Bob note', 'bob', sample_crackme['hexid'])
+
+    # Bob edits comment to mention Alice
+    response = bob_client.post(
+        f"/comment/{comment['_id']}/edit",
+        data={'comment': 'Bob note @alice check this'}
+    )
+    assert response.status_code == 302
+    assert db.notifications.count_documents({'user': 'alice'}) == 1
+
+
+def test_comment_delete_nonexistent_handled(bob_client):
+    response = bob_client.post("/comment/507f1f77bcf86cd799439011/delete")
+    assert response.status_code == 302
+
diff --git a/tests/test_models_extended.py b/tests/test_models_extended.py
index bb8b962..3b5d85c 100644
--- a/tests/test_models_extended.py
+++ b/tests/test_models_extended.py
@@ -61,6 +61,7 @@ def test_crackme_prepare_insert_update_and_delete(app, db):
 def test_comment_query_participant_and_spoiler_helpers(app, db, sample_crackme):
     from app.models.comment import (
         comment_by_id, comment_create, comment_set_spoiler,
+        comment_update, comment_delete,
         comments_by_user, count_comments_by_crackme, count_comments_by_user,
         get_thread_participants,
     )
@@ -74,6 +75,22 @@ def test_comment_query_participant_and_spoiler_helpers(app, db, sample_crackme):
     assert comment_by_id(str(first['_id']))['info'] == 'First'
     assert comment_set_spoiler(first['_id'], True)['spoiler'] is True
 
+    updated = comment_update(first['_id'], 'First Edited')
+    assert updated['info'] == 'First Edited'
+    assert updated['edited'] is True
+    assert updated['updated_at'] is not None
+
+    deleted = comment_delete(first['_id'])
+    assert deleted['_id'] == first['_id']
+    assert count_comments_by_user('alice') == 0
+
+    import pytest
+    from app.models.errors import ErrNoResult
+    with pytest.raises(ErrNoResult):
+        comment_update(first['_id'], 'Should fail')
+    with pytest.raises(ErrNoResult):
+        comment_delete(first['_id'])
+
 
 def test_solution_query_counter_and_author_helpers(app, db, sample_crackme):
     from app.models.solution import (

From e346509801edbf41330fb56ce9ed44d2458eb564 Mon Sep 17 00:00:00 2001
From: Kevin Thomas <kevin@mytechnotalent.com>
Date: Sun, 1 Nov 2026 10:04:18 -0500
Subject: [PATCH 2/2] Add comprehensive end-to-end integration tests for
 comment editing and deletion

---
 tests/test_comment_e2e.py | 228 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 228 insertions(+)
 create mode 100644 tests/test_comment_e2e.py

diff --git a/tests/test_comment_e2e.py b/tests/test_comment_e2e.py
new file mode 100644
index 0000000..9b71087
--- /dev/null
+++ b/tests/test_comment_e2e.py
@@ -0,0 +1,228 @@
+"""End-to-end integration tests for the full comment lifecycle:
+creation, UI rendering, editing, UI update, profile sync, deletion, and permission boundaries.
+"""
+
+from app.models.comment import comment_create
+
+
+def test_full_comment_lifecycle_end_to_end(alice_client, bob_client, client, db, sample_crackme, bob, alice):
+    hexid = sample_crackme['hexid']
+
+    # 1. Anonymous visitor views crackme comments before any comment is posted
+    resp = client.get(f"/crackme/{hexid}")
+    assert resp.status_code == 200
+    html = resp.data.decode('utf-8')
+    assert "Comments (0)" in html
+    assert "You must be logged in to post a comment" in html
+    assert "modal-edit-comment" in html
+
+    # 2. Bob logs in and posts a comment
+    post_resp = bob_client.post(f"/comment/{hexid}", data={
+        'comment': 'Initial comment with a typo: Great crackeme!'
+    }, follow_redirects=True)
+    assert post_resp.status_code == 200
+    post_html = post_resp.data.decode('utf-8')
+    assert "Comment uploaded!" in post_html
+
+    # Verify database state after creation
+    comment = db.comment.find_one({'author': 'bob', 'crackmehexid': hexid})
+    assert comment is not None
+    comment_id = str(comment['_id'])
+    assert comment['info'] == 'Initial comment with a typo: Great crackeme!'
+    assert comment.get('edited') is not True
+
+    crackme_doc = db.crackme.find_one({'hexid': hexid})
+    assert crackme_doc['nbcomments'] == 1
+
+    # 3. Verify Bob sees the Edit and Delete controls for his comment on the crackme page
+    bob_view = bob_client.get(f"/crackme/{hexid}")
+    assert bob_view.status_code == 200
+    bob_html = bob_view.data.decode('utf-8')
+    assert f"openEditCommentModal('{comment_id}')" in bob_html
+    assert f'action="/comment/{comment_id}/delete"' in bob_html
+    assert f'id="comment-raw-{comment_id}"' in bob_html
+    assert "Initial comment with a typo: Great crackeme!" in bob_html
+    assert "(edited)" not in bob_html
+
+    # 4. Verify Alice (crackme author, but not comment author) does NOT see edit or delete buttons for Bob's comment
+    alice_view = alice_client.get(f"/crackme/{hexid}")
+    assert alice_view.status_code == 200
+    alice_html = alice_view.data.decode('utf-8')
+    assert f"openEditCommentModal('{comment_id}')" not in alice_html
+    assert f'action="/comment/{comment_id}/delete"' not in alice_html
+    assert f'action="/comment/{comment_id}/spoiler"' in alice_html  # Crackme author can toggle spoiler
+
+    # 5. Verify Anonymous user does NOT see edit or delete buttons
+    anon_view = client.get(f"/crackme/{hexid}")
+    assert anon_view.status_code == 200
+    anon_html = anon_view.data.decode('utf-8')
+    assert f"openEditCommentModal('{comment_id}')" not in anon_html
+    assert f'action="/comment/{comment_id}/delete"' not in anon_html
+
+    # 6. Verify Bob's profile reflects the comment
+    bob_profile = client.get('/user/bob')
+    assert bob_profile.status_code == 200
+    profile_html = bob_profile.data.decode('utf-8')
+    assert "Initial comment with a typo: Great crackeme!" in profile_html
+
+    # 7. Bob edits his comment to fix the typo
+    edit_resp = bob_client.post(f"/comment/{comment_id}/edit", data={
+        'comment': 'Updated comment: Great crackme! Solved in Ghidra.'
+    }, follow_redirects=True)
+    assert edit_resp.status_code == 200
+    edit_html = edit_resp.data.decode('utf-8')
+    assert "Comment updated!" in edit_html
+
+    # Verify database state after edit
+    updated_comment = db.comment.find_one({'_id': comment['_id']})
+    assert updated_comment['info'] == 'Updated comment: Great crackme! Solved in Ghidra.'
+    assert updated_comment['edited'] is True
+    assert updated_comment['updated_at'] is not None
+
+    # 8. Verify the crackme page now shows the updated text and the (edited) indicator
+    view_after_edit = client.get(f"/crackme/{hexid}")
+    assert view_after_edit.status_code == 200
+    after_edit_html = view_after_edit.data.decode('utf-8')
+    assert "Updated comment: Great crackme! Solved in Ghidra." in after_edit_html
+    assert "(edited)" in after_edit_html
+    assert "Initial comment with a typo" not in after_edit_html
+
+    # Verify raw textarea for edit modal also contains the updated text
+    assert f'id="comment-raw-{comment_id}" style="display: none;">Updated comment: Great crackme! Solved in Ghidra.</textarea>' in after_edit_html
+
+    # 9. Verify Bob's profile reflects the edited comment
+    bob_profile_after_edit = client.get('/user/bob')
+    assert "Updated comment: Great crackme! Solved in Ghidra." in bob_profile_after_edit.data.decode('utf-8')
+
+    # 10. Negative tests: unauthorized attempts
+    # Alice attempts to edit Bob's comment
+    alice_edit_attempt = alice_client.post(f"/comment/{comment_id}/edit", data={
+        'comment': 'Hacked by Alice'
+    }, follow_redirects=True)
+    assert "You can only edit your own comments." in alice_edit_attempt.data.decode('utf-8')
+
+    # Alice attempts to delete Bob's comment
+    alice_delete_attempt = alice_client.post(f"/comment/{comment_id}/delete", follow_redirects=True)
+    assert "You can only delete your own comments." in alice_delete_attempt.data.decode('utf-8')
+
+    # Comment is still intact in DB
+    assert db.comment.count_documents({'_id': comment['_id']}) == 1
+    assert db.crackme.find_one({'hexid': hexid})['nbcomments'] == 1
+
+    # Bob attempts to submit empty edit
+    bob_empty_edit = bob_client.post(f"/comment/{comment_id}/edit", data={
+        'comment': '   '
+    }, follow_redirects=True)
+    assert "Comment cannot be empty." in bob_empty_edit.data.decode('utf-8')
+
+    # 11. Bob deletes his own comment
+    delete_resp = bob_client.post(f"/comment/{comment_id}/delete", follow_redirects=True)
+    assert delete_resp.status_code == 200
+    delete_html = delete_resp.data.decode('utf-8')
+    assert "Comment deleted." in delete_html
+
+    # 12. Verify DB and UI after deletion
+    # Comment is gone from DB
+    assert db.comment.find_one({'_id': comment['_id']}) is None
+    # Crackme counter decremented back to 0
+    assert db.crackme.find_one({'hexid': hexid})['nbcomments'] == 0
+
+    # Crackme page no longer displays the comment
+    final_crackme_view = client.get(f"/crackme/{hexid}")
+    final_crackme_html = final_crackme_view.data.decode('utf-8')
+    assert "Updated comment: Great crackme!" not in final_crackme_html
+    assert f"openEditCommentModal('{comment_id}')" not in final_crackme_html
+    assert "Comments (0)" in final_crackme_html
+
+    # Bob's profile shows 0 comments and no comment row
+    final_profile_view = client.get('/user/bob')
+    final_profile_html = final_profile_view.data.decode('utf-8')
+    assert "Updated comment: Great crackme!" not in final_profile_html
+
+
+def test_multi_comment_isolation_and_cascade_delete(alice_client, bob_client, client, db, sample_crackme, bob, alice):
+    hexid = sample_crackme['hexid']
+
+    # Alice posts comment 1
+    alice_client.post(f"/comment/{hexid}", data={'comment': 'Alice comment'})
+    c1 = db.comment.find_one({'author': 'alice', 'crackmehexid': hexid})
+    c1_id = str(c1['_id'])
+
+    # Bob posts comment 2
+    bob_client.post(f"/comment/{hexid}", data={'comment': 'Bob comment'})
+    c2 = db.comment.find_one({'author': 'bob', 'crackmehexid': hexid})
+    c2_id = str(c2['_id'])
+
+    assert db.crackme.find_one({'hexid': hexid})['nbcomments'] == 2
+
+    # Alice views page: Alice can edit/delete c1, but NOT c2
+    alice_html = alice_client.get(f"/crackme/{hexid}").data.decode('utf-8')
+    assert f"openEditCommentModal('{c1_id}')" in alice_html
+    assert f'action="/comment/{c1_id}/delete"' in alice_html
+    assert f"openEditCommentModal('{c2_id}')" not in alice_html
+    assert f'action="/comment/{c2_id}/delete"' not in alice_html
+
+    # Bob views page: Bob can edit/delete c2, but NOT c1
+    bob_html = bob_client.get(f"/crackme/{hexid}").data.decode('utf-8')
+    assert f"openEditCommentModal('{c2_id}')" in bob_html
+    assert f'action="/comment/{c2_id}/delete"' in bob_html
+    assert f"openEditCommentModal('{c1_id}')" not in bob_html
+    assert f'action="/comment/{c1_id}/delete"' not in bob_html
+
+    # Bob edits comment 2
+    bob_client.post(f"/comment/{c2_id}/edit", data={'comment': 'Bob comment edited'})
+    assert db.comment.find_one({'_id': c1['_id']})['info'] == 'Alice comment'
+    assert db.comment.find_one({'_id': c2['_id']})['info'] == 'Bob comment edited'
+
+    # Alice deletes comment 1
+    alice_client.post(f"/comment/{c1_id}/delete")
+    assert db.comment.find_one({'_id': c1['_id']}) is None
+    assert db.comment.find_one({'_id': c2['_id']}) is not None
+    assert db.crackme.find_one({'hexid': hexid})['nbcomments'] == 1
+
+    # Bob deletes comment 2
+    bob_client.post(f"/comment/{c2_id}/delete")
+    assert db.comment.find_one({'_id': c2['_id']}) is None
+    assert db.crackme.find_one({'hexid': hexid})['nbcomments'] == 0
+
+
+def test_comment_edit_sanitization_and_multiline(bob_client, client, db, sample_crackme, bob):
+    hexid = sample_crackme['hexid']
+
+    # Bob posts comment
+    bob_client.post(f"/comment/{hexid}", data={'comment': 'Clean text'})
+    c = db.comment.find_one({'author': 'bob', 'crackmehexid': hexid})
+    cid = str(c['_id'])
+
+    # Bob edits with HTML tags and newlines
+    evil_payload = "<script>alert(1)</script><b>Safe bold</b>\nLine two\nLine three"
+    bob_client.post(f"/comment/{cid}/edit", data={'comment': evil_payload})
+
+    updated = db.comment.find_one({'_id': c['_id']})
+    assert "<script>" not in updated['info']
+    assert "&lt;script&gt;alert(1)&lt;/script&gt;" in updated['info'] or "alert(1)" in updated['info']
+    assert "Line two\nLine three" in updated['info']
+
+    # View page and verify sanitization and formatting
+    html = client.get(f"/crackme/{hexid}").data.decode('utf-8')
+    assert "<script>alert" not in html
+    assert "(edited)" in html
+
+
+def test_unauthenticated_requests_redirected(client, db, sample_crackme):
+    hexid = sample_crackme['hexid']
+    comment = comment_create('Test', 'alice', hexid)
+    cid = str(comment['_id'])
+
+    # Anonymous post to edit
+    resp_edit = client.post(f"/comment/{cid}/edit", data={'comment': 'Hacked'})
+    assert resp_edit.status_code == 302
+    assert resp_edit.headers['Location'] == '/'
+    assert db.comment.find_one({'_id': comment['_id']})['info'] == 'Test'
+
+    # Anonymous post to delete
+    resp_del = client.post(f"/comment/{cid}/delete")
+    assert resp_del.status_code == 302
+    assert resp_del.headers['Location'] == '/'
+    assert db.comment.find_one({'_id': comment['_id']}) is not None
+