(core) Limiting doc remove permission to owners.

Summary:
Guest editors added to a document were able to remove it. This limits this permission
by allowing only owners of a doc to delete it.

Test Plan: Updated

Reviewers: paulfitz

Reviewed By: paulfitz

Subscribers: dsagal, anaisconce

Differential Revision: https://phab.getgrist.com/D3708
This commit is contained in:
Jarosław Sadziński
2022-11-30 23:10:07 +01:00
parent 601ba58a2e
commit 59942a23b6
4 changed files with 38 additions and 9 deletions

View File

@@ -488,7 +488,7 @@ export function makeDocOptionsMenu(home: HomeModel, doc: Document, renaming: Obs
testId('move-doc')
),
menuItem(deleteDoc, t('Remove'),
dom.cls('disabled', !roles.canDelete(doc.access)),
dom.cls('disabled', !roles.isOwner(doc)),
testId('delete-doc')
),
menuItem(() => home.pinUnpinDoc(doc.id, !doc.isPinned).catch(reportError),
@@ -511,11 +511,11 @@ export function makeRemovedDocOptionsMenu(home: HomeModel, doc: Document, worksp
return [
menuItem(() => home.restoreDoc(doc), t('Restore'),
dom.cls('disabled', !roles.canDelete(doc.access) || !!workspace.removedAt),
dom.cls('disabled', !roles.isOwner(doc) || !!workspace.removedAt),
testId('doc-restore')
),
menuItem(hardDeleteDoc, t('DeleteForever'),
dom.cls('disabled', !roles.canDelete(doc.access)),
dom.cls('disabled', !roles.isOwner(doc)),
testId('doc-delete-forever')
),
(workspace.removedAt ?