[erp5_web_renderjs_ui] Do not display save button on non editable document

bt5/erp5_hal_json_style/SkinTemplateItem/portal_skins/erp5_hal_json_style/ERP5Document_getHateoas.py

@@ -422,22 +422,27 @@ def renderForm(traversed_document, form, response_dict, key_prefix=None, selecti
   field_errors = REQUEST.get('field_errors', {})
 
   #hardcoded
+  include_action = True
   if form.pt == 'form_dialog':
     action_to_call = "Base_callDialogMethod"
   else:
     action_to_call = form.action
-
-  # Form action
-  response_dict['_actions'] = {
-    'put': {
-      "href": url_template_dict["form_action"] % {
-        "traversed_document_url": site_root.absolute_url() + "/" + traversed_document.getRelativeUrl(),
-        "action_id": action_to_call
-      },
-      "action": form.action,
-      "method": form.method,
+  if (action_to_call == 'Base_edit') and (not portal.portal_membership.checkPermission('Modify portal content', traversed_document)):
+    # prevent allowing editing if user doesn't have permission
+    include_action = False
+
+  if (include_action):
+    # Form action
+    response_dict['_actions'] = {
+      'put': {
+        "href": url_template_dict["form_action"] % {
+          "traversed_document_url": site_root.absolute_url() + "/" + traversed_document.getRelativeUrl(),
+          "action_id": action_to_call
+        },
+        "action": form.action,
+        "method": form.method,
+      }
     }
-  }
   # Form traversed_document
   response_dict['_links']['traversed_document'] = {
     "href": default_document_uri_template % {

bt5/erp5_hal_json_style/TestTemplateItem/portal_components/test.erp5.testHalJsonStyle.py

@@ -592,6 +592,79 @@ class TestERP5Document_getHateoas_mode_traverse(ERP5HALJSONStyleSkinsMixin):
     self.assertEqual(result_dict['_embedded']['_view']['_actions']['put']['method'], 'POST')
 
 
+  @simulate('Base_getRequestUrl', '*args, **kwargs',
+      'return "http://example.org/bar"')
+  @simulate('Base_getRequestHeader', '*args, **kwargs',
+            'return "application/hal+json"')
+  @changeSkin('Hal')
+  def test_getHateoasDocument_non_editable_default_view(self):
+    document = self._makeDocument()
+    # Drop editable permission
+    document.manage_permission('Modify portal content', [], 0)
+    document.Foo_view.listbox.ListBox_setPropertyList(
+      field_title = 'Foo Lines',
+      field_list_method = 'objectValues',
+      field_portal_types = 'Foo Line | Foo Line',
+      field_stat_method = 'portal_catalog',
+      field_stat_columns = 'quantity | Foo_statQuantity',
+      field_editable = 1,
+      field_columns = 'id|ID\ntitle|Title\nquantity|Quantity\nstart_date|Date\ncatalog.uid|Uid',
+      field_editable_columns = 'id|ID\ntitle|Title\nquantity|quantity\nstart_date|Date',
+      field_search_columns = 'id|ID\ntitle|Title\nquantity|Quantity\nstart_date|Date',)
+
+    parent = document.getParentValue()
+    fake_request = do_fake_request("GET")
+    result = self.portal.web_site_module.hateoas.ERP5Document_getHateoas(REQUEST=fake_request, mode="traverse", relative_url=document.getRelativeUrl(), view="view")
+    self.assertEquals(fake_request.RESPONSE.status, 200)
+    self.assertEquals(fake_request.RESPONSE.getHeader('Content-Type'),
+      "application/hal+json"
+    )
+    result_dict = json.loads(result)
+    self.assertEqual(result_dict['_links']['self'], {"href": "http://example.org/bar"})
+
+    self.assertEqual(result_dict['_links']['parent'],
+                    {"href": "urn:jio:get:%s" % parent.getRelativeUrl(), "name": parent.getTitle()})
+
+    self.assertEqual(result_dict['_links']['view'][0]['href'],
+                     "%s/web_site_module/hateoas/ERP5Document_getHateoas?mode=traverse&relative_url=%s&view=view" % (
+                       self.portal.absolute_url(),
+                       urllib.quote_plus(document.getRelativeUrl())))
+    self.assertEqual(result_dict['_links']['view'][0]['title'], "View")
+    self.assertEqual(result_dict['_links']['view'][0]['name'], "view")
+
+    self.assertEqual(result_dict['title'].encode("UTF-8"), document.getTitle())
+    self.assertEqual(result_dict['_debug'], "traverse")
+
+    # Check embedded form rendering
+    self.assertEqual(result_dict['_embedded']['_view']['form_id']['default'], 'Foo_view')
+    self.assertEqual(result_dict['_embedded']['_view']['form_id']['editable'], 0)
+    self.assertEqual(result_dict['_embedded']['_view']['form_id']['hidden'], 1)
+    self.assertEqual(result_dict['_embedded']['_view']['form_id']['key'], 'form_id')
+    self.assertEqual(result_dict['_embedded']['_view']['form_id']['required'], 1)
+    self.assertEqual(result_dict['_embedded']['_view']['form_id']['type'], 'StringField')
+
+    self.assertEqual(result_dict['_embedded']['_view']['my_id']['default'], document.getId())
+    self.assertEqual(result_dict['_embedded']['_view']['my_id']['editable'], 1)
+    self.assertEqual(result_dict['_embedded']['_view']['my_id']['hidden'], 0)
+    self.assertEqual(result_dict['_embedded']['_view']['my_id']['key'], 'field_my_id')
+    self.assertEqual(result_dict['_embedded']['_view']['my_id']['required'], 1)
+    self.assertEqual(result_dict['_embedded']['_view']['my_id']['type'], 'StringField')
+    self.assertEqual(result_dict['_embedded']['_view']['my_id']['title'], 'ID')
+
+    self.assertEqual(result_dict['_embedded']['_view']['_links']['traversed_document']['href'], 'urn:jio:get:%s' % document.getRelativeUrl())
+    self.assertEqual(result_dict['_embedded']['_view']['_links']['traversed_document']['name'], document.getRelativeUrl())
+    self.assertEqual(result_dict['_embedded']['_view']['_links']['traversed_document']['title'], document.getTitle().decode("UTF-8"))
+
+    self.assertEqual(result_dict['_embedded']['_view']['_links']['self']['href'], "%s/%s/Foo_view" % (
+                                                                                    self.portal.absolute_url(),
+                                                                                    document.getRelativeUrl()))
+
+    self.assertEqual(result_dict['_embedded']['_view']['_links']['form_definition']['href'], 'urn:jio:get:portal_skins/erp5_ui_test/Foo_view')
+    self.assertEqual(result_dict['_embedded']['_view']['_links']['form_definition']['name'], 'Foo_view')
+
+    self.assertFalse(result_dict['_embedded']['_view'].has_key('_actions'))
+
+
   @simulate('Base_getRequestUrl', '*args, **kwargs',
       'return "http://example.org/bar"')
   @simulate('Base_getRequestHeader', '*args, **kwargs',

bt5/erp5_ui_test/SkinTemplateItem/portal_skins/erp5_ui_test/Foo_createObjects.py

@@ -2,7 +2,9 @@
 from DateTime import DateTime
 date = DateTime('2009/01/01')
 for i in range(start, start + num):
-  context.newContent(id = str(i), title = 'Title %d' % i, start_date = date)
+  document = context.newContent(id = str(i), title = 'Title %d' % i, start_date = date)
+  if (editable == 0):
+    document.manage_permission('Modify portal content', [], 0)
   date += 1
 
 return 'Created Successfully.'

bt5/erp5_ui_test/SkinTemplateItem/portal_skins/erp5_ui_test/Foo_createObjects.xml

@@ -50,7 +50,7 @@
         </item>
         <item>
             <key> <string>_params</string> </key>
-            <value> <string>start=0, num=10</string> </value>
+            <value> <string>start=0, num=10, editable=None</string> </value>
         </item>
         <item>
             <key> <string>id</string> </key>

bt5/erp5_web_renderjs_ui/PathTemplateItem/web_page_module/rjs_gadget_erp5_pt_form_view_editable_js.js

@@ -39,13 +39,17 @@
     })
     .declareMethod('render', function (options) {
       var erp5_document = options.erp5_document,
-        form_gadget = this;
+        form_gadget = this,
+        action_dict = erp5_document._embedded._view._actions;
 
       form_gadget.props.id = options.jio_key;
       form_gadget.props.view = options.view;
-      form_gadget.props.action = erp5_document._embedded._view._actions.put;
       form_gadget.props.form_id = erp5_document._embedded._view.form_id;
 
+      if (action_dict !== undefined) {
+        form_gadget.props.action = erp5_document._embedded._view._actions.put;
+      }
+
       return form_gadget.getDeclaredGadget("erp5_form")
         .push(function (erp5_form) {
           var form_options = options.erp5_form || {},
@@ -82,8 +86,7 @@
           ]);
         })
         .push(function (all_result) {
-
-          return form_gadget.updateHeader({
+          var header_dict = {
             tab_url: all_result[2],
             cut_url: "",
             actions_url: all_result[3],
@@ -92,9 +95,13 @@
             // view_url: all_result[1],
             selection_url: all_result[6],
             page_title: options.erp5_document.title,
-            breadcrumb_url: all_result[4],
-            save_action: true
-          });
+            breadcrumb_url: all_result[4]
+          };
+          if (form_gadget.props.action !== undefined) {
+            header_dict.save_action = true;
+          }
+
+          return form_gadget.updateHeader(header_dict);
         });
     })
 
@@ -107,6 +114,10 @@
 
       function formSubmit() {
         var erp5_form;
+        if (form_gadget.props.action === undefined) {
+          // If not action is defined on form, do nothing
+          return;
+        }
         return form_gadget.getDeclaredGadget("erp5_form")
           .push(function (gadget) {
             erp5_form = gadget;

bt5/erp5_web_renderjs_ui/PathTemplateItem/web_page_module/rjs_gadget_erp5_pt_form_view_editable_js.xml

@@ -230,7 +230,7 @@
             </item>
             <item>
                 <key> <string>serial</string> </key>
-                <value> <string>949.21059.54877.18039</string> </value>
+                <value> <string>950.21284.14333.22084</string> </value>
             </item>
             <item>
                 <key> <string>state</string> </key>
@@ -248,7 +248,7 @@
                     </tuple>
                     <state>
                       <tuple>
-                        <float>1456157158.25</float>
+                        <float>1459936328.39</float>
                         <string>UTC</string>
                       </tuple>
                     </state>

bt5/erp5_web_renderjs_ui_test/PathTemplateItem/portal_tests/renderjs_ui_page_templates_zuite/testFormViewEditableSaveActionWithoutPermission.xml

+<?xml version="1.0"?>
+<ZopeData>
+  <record id="1" aka="AAAAAAAAAAE=">
+    <pickle>
+      <global name="ZopePageTemplate" module="Products.PageTemplates.ZopePageTemplate"/>
+    </pickle>
+    <pickle>
+      <dictionary>
+        <item>
+            <key> <string>_bind_names</string> </key>
+            <value>
+              <object>
+                <klass>
+                  <global name="NameAssignments" module="Shared.DC.Scripts.Bindings"/>
+                </klass>
+                <tuple/>
+                <state>
+                  <dictionary>
+                    <item>
+                        <key> <string>_asgns</string> </key>
+                        <value>
+                          <dictionary>
+                            <item>
+                                <key> <string>name_subpath</string> </key>
+                                <value> <string>traverse_subpath</string> </value>
+                            </item>
+                          </dictionary>
+                        </value>
+                    </item>
+                  </dictionary>
+                </state>
+              </object>
+            </value>
+        </item>
+        <item>
+            <key> <string>content_type</string> </key>
+            <value> <string>text/html</string> </value>
+        </item>
+        <item>
+            <key> <string>expand</string> </key>
+            <value> <int>0</int> </value>
+        </item>
+        <item>
+            <key> <string>id</string> </key>
+            <value> <string>testFormViewEditableSaveActionWithoutPermission</string> </value>
+        </item>
+        <item>
+            <key> <string>output_encoding</string> </key>
+            <value> <string>utf-8</string> </value>
+        </item>
+        <item>
+            <key> <string>title</string> </key>
+            <value> <unicode></unicode> </value>
+        </item>
+      </dictionary>
+    </pickle>
+  </record>
+</ZopeData>

bt5/erp5_web_renderjs_ui_test/PathTemplateItem/portal_tests/renderjs_ui_page_templates_zuite/testFormViewEditableSaveActionWithoutPermission.zpt

+<html xmlns:tal="http://xml.zope.org/namespaces/tal"
+      xmlns:metal="http://xml.zope.org/namespaces/metal">
+<head>
+<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
+<title>Test Form View Editable Save Action</title>
+</head>
+<body>
+<table cellpadding="1" cellspacing="1" border="1">
+<thead>
+<tr><td rowspan="1" colspan="3">Test non editable documents</td></tr>
+</thead><tbody>
+<!-- reuse listbox suite reset to clear modules. -->
+<tal:block metal:use-macro="here/Zuite_CommonTemplate/macros/init" />
+<tr>
+  <td>open</td>
+  <td>${base_url}/foo_module/ListBoxZuite_reset</td>
+  <td></td>
+</tr>
+<tr>
+  <td>assertTextPresent</td>
+  <td>Reset Successfully.</td>
+  <td></td>
+</tr>
+<tr>
+  <td>open</td>
+  <!-- create a Foo -->
+  <td>${base_url}/foo_module/Foo_createObjects?start:int=1&amp;num:int=1&amp;editable:int=0</td>
+  <td></td>
+</tr>
+<tr>
+  <td>assertTextPresent</td>
+  <td>Created Successfully.</td>
+  <td></td>
+</tr>
+<tr>
+  <td>open</td>
+  <td>${base_url}/foo_module/Zuite_waitForActivities</td>
+  <td></td>
+</tr>
+<tr>
+  <td>assertTextPresent</td>
+  <td>Done.</td>
+  <td></td>
+</tr>
+
+<tr>
+  <td>open</td>
+  <td>${base_url}/web_site_module/renderjs_runner/#/foo_module/1?editable=true</td>
+  <td></td>
+</tr>
+
+<!-- Wait for gadget to be loaded -->
+<tr>
+  <td>waitForElementPresent</td>
+  <td>//div[@data-gadget-url='${base_url}/web_site_module/renderjs_runner/gadget_erp5_pt_form_view_editable.html']</td>
+  <td></td>
+</tr>
+<tr>
+  <td>waitForTextPresent</td>
+  <td>Title 1</td>
+  <td></td>
+</tr>
+
+<!-- Header doesn't have a save button -->
+<tr>
+  <td>assertElementNotPresent</td>
+  <td>//div[@data-gadget-scope='header']//button[text()='Save' and @type='submit']</td>
+  <td></td>
+</tr>
+<tr>
+  <td>type</td>
+  <td>field_my_title</td>
+  <td>QWERTY</td>
+</tr>
+<!-- Submit the hidden form button-->
+<tr>
+  <td>click</td>
+  <td>//div[@data-gadget-scope='fg']//button[@type='submit']</td>
+  <td></td>
+</tr>
+<tr>
+  <td>pause</td>
+  <td>1000</td>
+  <td></td>
+</tr>
+<tr>
+  <td>assertElementPresent</td>
+  <td>//div[@data-gadget-scope='header']//a[text()='Title 1' and contains(@href, '#!change') and contains(@href, 'n.page=breadcrumb')]</td>
+  <td></td>
+</tr>
+<tr>
+  <td>assertTextNotPresent</td>
+  <td>QWERTY</td>
+  <td></td>
+</tr>
+
+</tbody></table>
+</body>
+</html>
\ No newline at end of file