MBS-13108: Require relationship editor, not admin, privs for attributes

lib/MusicBrainz/Server/Controller/Admin/Attributes.pm → lib/MusicBrainz/Server/Controller/Attributes.pm

@@ -1,4 +1,4 @@
-package MusicBrainz::Server::Controller::Admin::Attributes;
+package MusicBrainz::Server::Controller::Attributes;
 use Moose;
 use namespace::autoclean;
 use utf8;
@@ -8,57 +8,81 @@ use MusicBrainz::Server::Entity::Util::JSON qw( to_json_array );
 
 BEGIN { extends 'MusicBrainz::Server::Controller' }
 
-my @models = qw(
+my @entity_type_models = qw(
     AreaType
     ArtistType
     CollectionType
-    CoverArtType
     EventType
-    Gender
     InstrumentType
     LabelType
-    Language
-    MediumFormat
     PlaceType
     ReleaseGroupType
     ReleaseGroupSecondaryType
+    SeriesType
+    WorkType
+);
+
+my @alias_type_models = qw(
+    AreaAliasType
+    ArtistAliasType
+    EventAliasType
+    GenreAliasType
+    InstrumentAliasType
+    LabelAliasType
+    PlaceAliasType
+    RecordingAliasType
+    ReleaseAliasType
+    ReleaseGroupAliasType
+    SeriesAliasType
+    WorkAliasType
+);
+
+my @other_models = qw(
+    CoverArtType
+    Gender
+    Language
+    MediumFormat
     ReleaseStatus
     ReleasePackaging
     Script
-    SeriesType
-    WorkType
     WorkAttributeType
 );
-# Missing: Alias types, WorkAttributeTypeAllowedValue
 
-sub index : Path('/admin/attributes') Args(0) RequireAuth(account_admin) {
+my @all_models = (@entity_type_models, @alias_type_models, @other_models);
+# Missing: WorkAttributeTypeAllowedValue
+
+sub index : Path('/attributes') Args(0) {
     my ($self, $c) = @_;
 
     $c->stash(
         current_view => 'Node',
-        component_path => 'admin/attributes/Index',
-        component_props => {models => \@models},
+        component_path => 'attributes/AttributesList',
+        component_props => {
+            aliasTypeModels => \@alias_type_models,
+            entityTypeModels => \@entity_type_models,
+            otherModels => \@other_models,
+        },
     );
 }
 
-sub attribute_base : Chained('/') PathPart('admin/attributes') CaptureArgs(1) RequireAuth(account_admin) {
+sub attribute_base : Chained('/') PathPart('attributes') CaptureArgs(1) {
     my ($self, $c, $model) = @_;
 
-    $c->detach('/error_404') unless contains_string(\@models, $model);
+    $c->detach('/error_404') unless contains_string(\@all_models, $model);
 
     $c->stash->{model} = $model;
 }
 
-sub attribute_index : Chained('attribute_base') PathPart('') RequireAuth(account_admin) {
+sub attribute_index : Chained('attribute_base') PathPart('') {
     my ($self, $c) = @_;
     my $model = $c->stash->{model};
     my @attr = $c->model($model)->get_all();
 
     my %component_paths = (
-        Language => 'admin/attributes/Language',
-        Script => 'admin/attributes/Script',
+        Language => 'attributes/Language',
+        Script => 'attributes/Script',
     );
-    my $component_path = $component_paths{$model} // 'admin/attributes/Attribute';
+    my $component_path = $component_paths{$model} // 'attributes/Attribute';
 
     $c->stash(
         current_view => 'Node',
@@ -70,50 +94,50 @@ sub attribute_index : Chained('attribute_base') PathPart('') RequireAuth(account
     );
 }
 
-sub create : Chained('attribute_base') RequireAuth(account_admin) SecureForm {
+sub create : Chained('attribute_base') RequireAuth(relationship_editor) SecureForm {
     my ($self, $c) = @_;
     my $model = $c->stash->{model};
 
     my %forms = (
-        Language => 'Admin::Attributes::Language',
-        Script => 'Admin::Attributes::Script',
+        Language => 'Attributes::Language',
+        Script => 'Attributes::Script',
     );
-    my $form_name = $forms{$model} // 'Admin::Attributes';
+    my $form_name = $forms{$model} // 'Attributes::Generic';
     my $form = $c->form( form => $form_name );
 
     if ($c->form_posted_and_valid($form)) {
         $c->model('MB')->with_transaction(sub {
             $c->model($model)->insert({ map { $_->name => $_->value } $form->edit_fields });
         });
 
-        $c->response->redirect($c->uri_for('/admin/attributes', $model));
+        $c->response->redirect($c->uri_for('/attributes', $model));
         $c->detach;
     }
 }
 
-sub edit : Chained('attribute_base') Args(1) RequireAuth(account_admin) SecureForm {
+sub edit : Chained('attribute_base') Args(1) RequireAuth(relationship_editor) SecureForm {
     my ($self, $c, $id) = @_;
     my $model = $c->stash->{model};
     my $attr = $c->model($model)->get_by_id($id);
 
     my %forms = (
-        Language => 'Admin::Attributes::Language',
-        Script => 'Admin::Attributes::Script',
+        Language => 'Attributes::Language',
+        Script => 'Attributes::Script',
     );
-    my $form_name = $forms{$model} // 'Admin::Attributes';
+    my $form_name = $forms{$model} // 'Attributes::Generic';
     my $form = $c->form( form => $form_name, init_object => $attr );
 
     if ($c->form_posted_and_valid($form)) {
         $c->model('MB')->with_transaction(sub {
             $c->model($model)->update($id, { map { $_->name => $_->value } $form->edit_fields });
         });
 
-        $c->response->redirect($c->uri_for('/admin/attributes', $model));
+        $c->response->redirect($c->uri_for('/attributes', $model));
         $c->detach;
     }
 }
 
-sub delete : Chained('attribute_base') Args(1) RequireAuth(account_admin) SecureForm {
+sub delete : Chained('attribute_base') Args(1) RequireAuth(relationship_editor) SecureForm {
     my ($self, $c, $id) = @_;
     my $model = $c->stash->{model};
     my $attr = $c->model($model)->get_by_id($id)
@@ -130,7 +154,7 @@ sub delete : Chained('attribute_base') Args(1) RequireAuth(account_admin) Secure
 
         $c->stash(
             current_view => 'Node',
-            component_path => 'admin/attributes/CannotRemoveAttribute',
+            component_path => 'attributes/CannotRemoveAttribute',
             component_props => {message => $error_message},
         );
 
@@ -143,15 +167,15 @@ sub delete : Chained('attribute_base') Args(1) RequireAuth(account_admin) Secure
 
         $c->stash(
             current_view => 'Node',
-            component_path => 'admin/attributes/CannotRemoveAttribute',
+            component_path => 'attributes/CannotRemoveAttribute',
             component_props => {message => $error_message},
         );
 
         $c->detach;
     }
 
     $c->stash(
-        component_path  => 'admin/attributes/DeleteAttribute',
+        component_path  => 'attributes/DeleteAttribute',
         component_props => {
             attribute => $attr->TO_JSON,
             form => $form->TO_JSON,
@@ -168,7 +192,7 @@ sub delete : Chained('attribute_base') Args(1) RequireAuth(account_admin) Secure
             });
         }
 
-        $c->response->redirect($c->uri_for('/admin/attributes', $model));
+        $c->response->redirect($c->uri_for('/attributes', $model));
         $c->detach;
     }
 }

lib/MusicBrainz/Server/Data/Role/AliasType.pm

@@ -5,16 +5,24 @@ use namespace::autoclean;
 use MusicBrainz::Server::Entity::AliasType;
 use MusicBrainz::Server::Data::Utils qw( load_subobjects );
 
-with 'MusicBrainz::Server::Data::Role::OptionsTree';
-
-sub _columns { 'id, gid, name, parent AS parent_id, child_order, description' }
+with 'MusicBrainz::Server::Data::Role::OptionsTree',
+     'MusicBrainz::Server::Data::Role::Attribute';
 
 sub load {
     my ($self, @objs) = @_;
 
     load_subobjects($self, 'type', @objs);
 }
 
+sub in_use {
+    my ($self, $id) = @_;
+    # We can get the alias table by just dropping "_type" from the type table
+    my $alias_table = $self->_table =~ s/_type$//r;
+    return $self->sql->select_single_value(
+        "SELECT 1 FROM $alias_table WHERE type = ? LIMIT 1",
+        $id);
+}
+
 1;
 
 =head1 COPYRIGHT AND LICENSE

lib/MusicBrainz/Server/Form/Admin/Attributes.pm → lib/MusicBrainz/Server/Form/Attributes/Generic.pm

@@ -1,4 +1,4 @@
-package MusicBrainz::Server::Form::Admin::Attributes;
+package MusicBrainz::Server::Form::Attributes::Generic;
 use strict;
 use warnings;
 

lib/MusicBrainz/Server/Form/Admin/Attributes/Language.pm → lib/MusicBrainz/Server/Form/Attributes/Language.pm

@@ -1,4 +1,4 @@
-package MusicBrainz::Server::Form::Admin::Attributes::Language;
+package MusicBrainz::Server::Form::Attributes::Language;
 use strict;
 use warnings;
 

lib/MusicBrainz/Server/Form/Admin/Attributes/Script.pm → lib/MusicBrainz/Server/Form/Attributes/Script.pm

@@ -1,4 +1,4 @@
-package MusicBrainz::Server::Form::Admin::Attributes::Script;
+package MusicBrainz::Server::Form::Attributes::Script;
 use strict;
 use warnings;