FEATURE: New site setting, `allow staff flags`, false by default

For some large communities, it makes sense to disable flagging of
staff posts.

config/locales/server.en.yml

@@ -1282,6 +1282,7 @@ en:
     tl3_links_no_follow: "Do not remove rel=nofollow from links posted by trust level 3 users."
 
     min_trust_to_create_topic: "The minimum trust level required to create a new topic."
+    allow_staff_flags: "If enabled, users can flag posts from staff accounts."
 
     min_trust_to_edit_wiki_post: "The minimum trust level required to edit post marked as wiki."
 

config/site_settings.yml

@@ -900,6 +900,7 @@ trust:
   min_trust_to_post_links:
     default: 0
     enum: 'TrustLevelSetting'
+  allow_staff_flags: true
   tl1_requires_topics_entered: 5
   tl1_requires_read_posts:
     default: 30

lib/guardian/post_guardian.rb

@@ -21,6 +21,9 @@ module PostGuardian
 
     result = if authenticated? && post && !@user.anonymous?
 
+      # post made by staff, but we don't allow staff flags
+      return false if !SiteSetting.allow_staff_flags? && post.user.staff?
+
       return false if [:notify_user, :notify_moderators].include?(action_key) &&
         !SiteSetting.enable_personal_messages?
 

spec/components/guardian_spec.rb

@@ -66,11 +66,23 @@ describe Guardian do
       expect(Guardian.new(user).post_can_act?(post, :like)).to be_falsey
     end
 
-    it "always allows flagging" do
+    it "allows flagging archived posts" do
       post.topic.archived = true
       expect(Guardian.new(user).post_can_act?(post, :spam)).to be_truthy
     end
 
+    it "allows flagging of staff posts when allow_staff_flags is true" do
+      SiteSetting.allow_staff_flags = true
+      staff_post = Fabricate(:post, user: Fabricate(:moderator))
+      expect(Guardian.new(user).post_can_act?(staff_post, :spam)).to be_truthy
+    end
+
+    it "doesn't allow flagging of staff posts when allow_staff_flags is false" do
+      SiteSetting.allow_staff_flags = false
+      staff_post = Fabricate(:post, user: Fabricate(:moderator))
+      expect(Guardian.new(user).post_can_act?(staff_post, :spam)).to eq(false)
+    end
+
     it "returns false when liking yourself" do
       expect(Guardian.new(post.user).post_can_act?(post, :like)).to be_falsey
     end