Use own permission for layoutedit tab.

Permission is: 'collective.cover: Can Edit Layout'

src/collective/cover/configure.zcml

@@ -20,6 +20,11 @@
       title="collective.cover: Can Export Layout"
       />
 
+  <permission
+      id="collective.cover.CanEditLayout"
+      title="collective.cover: Can Edit Layout"
+      />
+
   <grok:grok package="." />
 
   <include package=".tiles" />

src/collective/cover/content.py

@@ -168,7 +168,7 @@ def update(self):
 # XXX: we need to leave the view after saving or cancelling editing
 class LayoutEdit(grok.View):
     grok.context(ICover)
-    grok.require('cmf.ModifyPortalContent')
+    grok.require('collective.cover.CanEditLayout')
 
     def update(self):
         self.context = aq_inner(self.context)

src/collective/cover/profiles.zcml

@@ -61,6 +61,12 @@
         handler=".upgrades.issue_330"
         />
 
+    <genericsetup:upgradeStep
+        title="New permission for Layout edit tab"
+        description="Protect Layout edit tab with new permission granted to Managers and Site Admins"
+        handler=".upgrades.layout_edit_permission"
+        />
+
   </genericsetup:upgradeSteps>
 
 </configure>

src/collective/cover/profiles/default/rolemap.xml

@@ -5,5 +5,9 @@
        <role name="Manager"/>
        <role name="Site Administrator"/>
      </permission>
+     <permission name="collective.cover: Can Edit Layout" acquire="False">
+       <role name="Manager"/>
+       <role name="Site Administrator"/>
+     </permission>
    </permissions>
  </rolemap>

src/collective/cover/profiles/default/types/collective.cover.content.xml

@@ -62,6 +62,6 @@
   <action title="Layout" action_id="layoutedit" category="object"
     condition_expr="not:object/@@plone_lock_info/is_locked_for_current_user|python:True"
     url_expr="string:${object_url}/layoutedit" visible="True" i18n:attributes="title">
-    <permission value="Modify portal content" />
+    <permission value="collective.cover: Can Edit Layout" />
   </action>
 </object>

src/collective/cover/tests/test_upgrades.py

@@ -1,5 +1,6 @@
 # -*- coding: utf-8 -*-
 
+from Products.CMFCore.utils import getToolByName
 from collective.cover.config import DEFAULT_GRID_SYSTEM
 from collective.cover.testing import INTEGRATION_TESTING
 from plone.registry.interfaces import IRegistry
@@ -129,7 +130,7 @@ def setUp(self):
     def test_upgrade_to_7_registrations(self):
         version = self.setup.getLastVersionForProfile(self.profile_id)[0]
         self.assertTrue(version >= self.to_version)
-        self.assertEqual(self._how_many_upgrades_to_do(), 1)
+        self.assertEqual(self._how_many_upgrades_to_do(), 2)
 
     def test_issue_330(self):
         # check if the upgrade step is registered
@@ -149,3 +150,25 @@ def test_issue_330(self):
         self._do_upgrade_step(step)
         self.assertEqual(registry.records[record_name].value,
                          DEFAULT_GRID_SYSTEM)
+
+    def test_layout_edit_permission(self):
+        # check if the upgrade step is registered
+        title = u'New permission for Layout edit tab'
+        description = (u'Protect Layout edit tab with new permission '
+                       u'granted to Managers and Site Admins')
+
+        step = self._get_upgrade_step(title)
+        self.assertIsNotNone(step)
+        self.assertEqual(step['description'], description)
+
+        # simulate state on previous version
+        types = getToolByName(self.portal, 'portal_types')
+        cover_type = types['collective.cover.content']
+        action = cover_type.getActionObject('object/layoutedit')
+        action.permissions = (u'Modify portal content', )
+
+        # run the upgrade step to validate the update
+        self._do_upgrade_step(step)
+        action = cover_type.getActionObject('object/layoutedit')
+        self.assertEqual(action.permissions,
+                         (u'collective.cover: Can Edit Layout', ))

src/collective/cover/upgrades.py

@@ -9,6 +9,7 @@
 import logging
 
 logger = logging.getLogger(PROJECTNAME)
+PROFILE_ID = 'profile-collective.cover:default'
 
 
 def issue_201(context):
@@ -69,3 +70,12 @@ def issue_330(context):
     # Reregister the interface.
     registry = getUtility(IRegistry)
     registry.registerInterface(ICoverSettings)
+
+
+def layout_edit_permission(context):
+    """New permission for Layout edit tab.
+
+    We need to apply our rolemap and typeinfo for this.
+    """
+    context.runImportStepFromProfile(PROFILE_ID, 'rolemap')
+    context.runImportStepFromProfile(PROFILE_ID, 'typeinfo')