From 6b987c64bcf6b250bbf7a954553c43352780993b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Nicolas=20G=C3=A9raud?= <nicolas.geraud@gmail.com>
Date: Wed, 14 Nov 2018 18:00:10 +0100
Subject: [PATCH] fix(plan): access plan management with only read permission

fix gravitee-io/issues#1659
---
 .../api/portal/plans/list-plans.controller.ts          |  2 +-
 src/management/api/portal/plans/list-plans.html        | 10 +++++-----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/src/management/api/portal/plans/list-plans.controller.ts b/src/management/api/portal/plans/list-plans.controller.ts
index cda21e7cb5..97fc31be6a 100644
--- a/src/management/api/portal/plans/list-plans.controller.ts
+++ b/src/management/api/portal/plans/list-plans.controller.ts
@@ -97,7 +97,7 @@ class ApiListPlansController {
 
   changeFilter(statusFilter) {
     this.selectedStatus = statusFilter;
-    this.dndEnabled = (statusFilter === 'published');
+    this.dndEnabled = (statusFilter === 'published') && this.UserService.isUserHasPermissions(['api-plan-u']);
 
     if (_.includes(this.selectedStatus, statusFilter)) {
       _.pull(this.selectedStatus, statusFilter);
diff --git a/src/management/api/portal/plans/list-plans.html b/src/management/api/portal/plans/list-plans.html
index 6f4e20318a..30ae4ea6a0 100644
--- a/src/management/api/portal/plans/list-plans.html
+++ b/src/management/api/portal/plans/list-plans.html
@@ -42,15 +42,15 @@ <h4 ng-class="{italic: plan.status === 'staging', strike: plan.status === 'close
             <span style="font-size: 12px;">Authentication: {{plan.security}}</span>
           </div>
           <span flex></span>
-          <span ng-if="plan.status !== 'closed'">
-            <md-tooltip md-direction="top">Configure plan</md-tooltip>
+          <span ng-if="plan.status !== 'closed'" permission permission-only="'api-plan-u'">
+            <md-tooltip md-direction="top">Configurezzzz plan</md-tooltip>
             <ng-md-icon style="fill: grey;" icon="mode_edit" ng-click="$ctrl.editPlan(plan)"></ng-md-icon>
           </span>
-          <span ng-if="plan.status === 'staging'">
+          <span ng-if="plan.status === 'staging'" permission permission-only="'api-plan-u'">
             <md-tooltip md-direction="top">Publish plan</md-tooltip>
             <ng-md-icon style="fill: #6ba2c5;" icon="backup" ng-click="$ctrl.publish(plan)"></ng-md-icon>
           </span>
-          <span ng-if="plan.status !== 'closed'">
+          <span ng-if="plan.status !== 'closed'" permission permission-only="'api-plan-u'">
             <md-tooltip md-direction="top">Close plan</md-tooltip>
             <ng-md-icon style="fill: #d3091d;" icon="close" ng-click="$ctrl.close(plan)"></ng-md-icon>
           </span>
@@ -82,7 +82,7 @@ <h5 class="gravitee-plan-content">{{characteristic}}</h5>
   </md-card>
   </div>
     </div>
-    <div permission permission-only="'api-definition-u'" layout="row" layout-align="center" layout-wrap>
+    <div permission permission-only="'api-plan-u'" layout="row" layout-align="center" layout-wrap>
       <span ng-if="$ctrl.filteredPlans.length != 0 && $ctrl.dndEnabled"><ng-md-icon icon="info" style="fill: #b1bdc5;"></ng-md-icon> Plans can be re-ordered by dragging & dropping them.</span>
     </div>
   </div>