refs #317: hide review buttons when user is not an editor.

Kinto · Nov 16, 2016 · a8176d3 · a8176d3
1 parent 3aac2b5
commit a8176d3
Show file tree

Hide file tree

Showing 4 changed files with 23 additions and 5 deletions.
diff --git a/src/plugins/signoff/components.js b/src/plugins/signoff/components.js
@@ -19,6 +19,25 @@ import AdminLink from "../../components/AdminLink";
 import { ProgressBar, ProgressStep } from "./ProgressBar.js";
 
 
+function isEditor(sessionState, bucketState) {
+  if (typeof sessionState.serverInfo.user !== "object") {
+    return false;
+  }
+  const {serverInfo: {user, capabilities}} = sessionState;
+  if (user == null) {
+    return false;
+  }
+  const {signer={}} = capabilities;
+  const {editors_group: groupName} = signer;
+  const {id: userId} = user;
+  const {groups} = bucketState;
+  const editorGroup = groups.find(g => g.id === groupName);
+  if (!editorGroup) {
+    return false;
+  }
+  return editorGroup.members.includes(userId);
+}
+
 export default class SignoffToolBar extends React.Component {
   props: {
     sessionState: SessionState,
@@ -67,13 +86,13 @@ export default class SignoffToolBar extends React.Component {
         <WorkInProgress label="Work in progress"
                         step={0}
                         currentStep={step}
-                        canEdit={canEdit}
+                        canEdit={canEdit && isEditor(sessionState, bucketState)}
                         requestReview={requestReview}
                         source={source} />
         <Review label="Waiting review"
                 step={1}
                 currentStep={step}
-                canEdit={canEdit}
+                canEdit={canEdit && isEditor(sessionState, bucketState)}
                 approveChanges={approveChanges}
                 declineChanges={declineChanges}
                 source={source}

diff --git a/src/reducers/session.js b/src/reducers/session.js
@@ -22,7 +22,6 @@ const DEFAULT: SessionState = {
   buckets: [],
   serverInfo: {
     capabilities: {},
-    user: {},
   },
   redirectURL: null,
 };

diff --git a/src/types.js b/src/types.js
@@ -59,6 +59,7 @@ export type Capabilities = {
   history?: Object,
   permissions_endpoint?: Object,
   schema?: Object,
+  signer?: Object,
 };
 
 export type ClientError = {
@@ -253,7 +254,7 @@ export type SessionState = {
 export type ServerInfo = {
   capabilities: Capabilities,
   user?: {
-    id?: string,
+    id: string,
     bucket?: string,
   }
 };

diff --git a/test/reducers/sessions_test.js b/test/reducers/sessions_test.js
@@ -44,7 +44,6 @@ describe("session reducer", () => {
       redirectURL: null,
       serverInfo: {
         capabilities: {},
-        user: {},
       },
     });
   });