Web: support for new capabilities (#338)

* Web: respect new capabilities * Add new permissions to Capabilities.js Co-authored-by: Krzysztof <krzysztof.wielocha@nask.pl>
CERT-Polska · Apr 7, 2021 · c76538a · c76538a
1 parent 379655c
commit c76538a
Show file tree

Hide file tree

Showing 7 changed files with 69 additions and 33 deletions.
diff --git a/mwdb/web/src/App.js b/mwdb/web/src/App.js
@@ -62,6 +62,7 @@ import {
 } from "@fortawesome/free-solid-svg-icons";
 import { faStar as farStar } from "@fortawesome/free-regular-svg-icons";
 
+import { AuthContext } from "@mwdb-web/commons/auth";
 import { ConfigContext } from "@mwdb-web/commons/config";
 import { fromPlugin } from "@mwdb-web/commons/extensions";
 import {
@@ -115,6 +116,7 @@ function DefaultRoute() {
 }
 
 export default function App() {
+    const auth = useContext(AuthContext);
     const config = useContext(ConfigContext);
 
     const routeSwitch = config.config ? (
@@ -144,7 +146,11 @@ export default function App() {
             <ProtectedRoute exact path="/blobs">
                 <RecentBlobs />
             </ProtectedRoute>
-            <ProtectedRoute exact path="/upload">
+            <ProtectedRoute
+                exact
+                path="/upload"
+                condition={auth.hasCapability("adding_files")}
+            >
                 <Upload />
             </ProtectedRoute>
             <ProtectedRoute exact path="/search">

diff --git a/mwdb/web/src/components/Capabilities.js b/mwdb/web/src/components/Capabilities.js
@@ -22,6 +22,9 @@ export let capabilitiesList = {
     adding_blobs: "Can upload text blobs",
     unlimited_requests: "API requests are not rate-limited for this group",
     removing_objects: "Can remove objects",
+    adding_files: "Can add files",
+    manage_profile: "Can manage own profile",
+    personalize: "Can mark favorites and manage own quick queries",
 };
 
 for (let extraCapabilities of fromPlugin("capabilities")) {

diff --git a/mwdb/web/src/components/Navigation.js b/mwdb/web/src/components/Navigation.js
@@ -112,6 +112,27 @@ function RemoteDropdown() {
     );
 }
 
+function UploadButton() {
+    const auth = useContext(AuthContext);
+    const buttonLink = auth.hasCapability("adding_files") ? (
+        <Link className="nav-link" to={"/upload"}>
+            <FontAwesomeIcon className="navbar-icon" icon={faUpload} />
+            Upload
+        </Link>
+    ) : (
+        <div className="nav-link text-muted">
+            <span
+                data-toggle="tooltip"
+                title="File upload is disabled for your account"
+            >
+                <FontAwesomeIcon className="navbar-icon" icon={faUpload} />
+                Upload
+            </span>
+        </div>
+    );
+    return buttonLink;
+}
+
 export default function Navigation() {
     const auth = useContext(AuthContext);
     const config = useContext(ConfigContext);
@@ -161,13 +182,7 @@ export default function Navigation() {
                         </Link>
                     </li>
                     <li className="nav-item">
-                        <Link className="nav-link" to={"/upload"}>
-                            <FontAwesomeIcon
-                                className="navbar-icon"
-                                icon={faUpload}
-                            />
-                            Upload
-                        </Link>
+                        <UploadButton />
                     </li>
                 </Extendable>
             ) : (

diff --git a/mwdb/web/src/components/RecentView/QuickQuery.js b/mwdb/web/src/components/RecentView/QuickQuery.js
@@ -106,7 +106,7 @@ export default function QuickQuery(props) {
                 props.addToQuery("NOT shared", "public");
             }}
         />,
-        !api.remote && (
+        !api.remote && auth.hasCapability("personalize") && (
             <QuickQueryItem
                 key="favorites"
                 label="Favorites"
@@ -148,11 +148,14 @@ export default function QuickQuery(props) {
                     ev.preventDefault();
                     props.submitQuery(v.query);
                 }}
-                onDelete={(ev) => {
-                    ev.preventDefault();
-                    setIdToRemove(v.id);
-                    setDeleteModalOpen(true);
-                }}
+                onDelete={
+                    auth.hasCapability("personalize") &&
+                    ((ev) => {
+                        ev.preventDefault();
+                        setIdToRemove(v.id);
+                        setDeleteModalOpen(true);
+                    })
+                }
             />
         ));
 
@@ -180,7 +183,7 @@ export default function QuickQuery(props) {
     const userQuickQueryBadges = !api.remote ? (
         <React.Fragment>
             {queryBadges}
-            {newQuickQueryButton}
+            {auth.hasCapability("personalize") ? newQuickQueryButton : []}
             <ConfirmationModal
                 buttonStyle="badge-success"
                 confirmText="Yes"

diff --git a/mwdb/web/src/components/ShowObject/Actions/FavoriteAction.js b/mwdb/web/src/components/ShowObject/Actions/FavoriteAction.js
@@ -4,11 +4,13 @@ import { faStar } from "@fortawesome/free-solid-svg-icons";
 import { faStar as farStar } from "@fortawesome/free-regular-svg-icons";
 
 import { APIContext } from "@mwdb-web/commons/api/context";
+import { AuthContext } from "@mwdb-web/commons/auth";
 import { ObjectContext } from "@mwdb-web/commons/context";
 import { ObjectAction } from "@mwdb-web/commons/ui";
 
 export default function FavoriteAction() {
     const api = useContext(APIContext);
+    const auth = useContext(AuthContext);
     const context = useContext(ObjectContext);
 
     async function markFavoriteObject() {
@@ -29,7 +31,7 @@ export default function FavoriteAction() {
         }
     }
 
-    if (api.remote) return [];
+    if (!auth.hasCapability("personalize") || api.remote) return [];
 
     if (context.object.favorite)
         return (

diff --git a/mwdb/web/src/components/ShowObject/Actions/UploadChildAction.js b/mwdb/web/src/components/ShowObject/Actions/UploadChildAction.js
@@ -12,7 +12,12 @@ export default function RemoveAction() {
     const context = useContext(ObjectContext);
 
     // If user can't add parents: don't show the action
-    if (!auth.hasCapability("adding_parents") || api.remote) return [];
+    if (
+        !auth.hasCapability("adding_parents") ||
+        !auth.hasCapability("adding_files") ||
+        api.remote
+    )
+        return [];
 
     return (
         <ObjectAction

diff --git a/mwdb/web/src/components/UserProfile.js b/mwdb/web/src/components/UserProfile.js
@@ -147,7 +147,7 @@ class UserProfile extends Component {
                                         <ul className="table-ul">
                                             {this.capabilities.map((c) => (
                                                 <li>
-                                                    {capabilitiesList[c]}
+                                                    {capabilitiesList[c]}{" "}
                                                     (inherited from:{" "}
                                                     {this.inheritedFrom(c).join(
                                                         ", "
@@ -174,7 +174,8 @@ class UserProfile extends Component {
                         <tr className="d-flex">
                             <td className="col-12" colspan="3">
                                 {this.context.user.login ===
-                                this.state.profile.login ? (
+                                    this.state.profile.login &&
+                                this.context.hasCapability("manage_profile") ? (
                                     <button
                                         type="button"
                                         className="btn btn-success"
@@ -205,20 +206,21 @@ class UserProfile extends Component {
                         </tr>
                     </tbody>
                 </table>
-                {this.context.user.login === this.state.profile.login && (
-                    <div>
-                        <h4>API keys</h4>
-                        <ManageAPIKeys
-                            items={this.state.profile.api_keys}
-                            userLogin={this.context.user.login}
-                            onSuccess={(success) => {
-                                this.handleUpdate();
-                                this.setState({ success });
-                            }}
-                            onError={(error) => this.setState({ error })}
-                        />
-                    </div>
-                )}
+                {this.context.user.login === this.state.profile.login &&
+                    this.context.hasCapability("manage_profile") && (
+                        <div>
+                            <h4>API keys</h4>
+                            <ManageAPIKeys
+                                items={this.state.profile.api_keys}
+                                userLogin={this.context.user.login}
+                                onSuccess={(success) => {
+                                    this.handleUpdate();
+                                    this.setState({ success });
+                                }}
+                                onError={(error) => this.setState({ error })}
+                            />
+                        </div>
+                    )}
             </View>
         );
     }