From cd9260f439b7e06b98efbdccb2ad47df057c5184 Mon Sep 17 00:00:00 2001
From: Oleksii Kriuchykhin <okriuchykhin@biosistemika.com>
Date: Fri, 9 Mar 2018 16:19:36 +0100
Subject: [PATCH] Hide delete button for guest users in repository [SCI-2163]

---
 app/permissions/team.rb                     |  5 +++++
 app/views/repositories/_repository.html.erb | 17 +++++++++--------
 2 files changed, 14 insertions(+), 8 deletions(-)

diff --git a/app/permissions/team.rb b/app/permissions/team.rb
index a54eefbc4..a27c56585 100644
--- a/app/permissions/team.rb
+++ b/app/permissions/team.rb
@@ -52,6 +52,11 @@ Canaid::Permissions.register_for(Team) do
     user.is_normal_user_or_admin_of_team?(team)
   end
 
+  # repository: update/delete records
+  can :manage_repository_rows do |user, team|
+    user.is_normal_user_or_admin_of_team?(team)
+  end
+
   # repository: create field
   can :create_repository_columns do |user, team|
     user.is_normal_user_or_admin_of_team?(team)
diff --git a/app/views/repositories/_repository.html.erb b/app/views/repositories/_repository.html.erb
index ee5fa4ea3..1db7cf18d 100644
--- a/app/views/repositories/_repository.html.erb
+++ b/app/views/repositories/_repository.html.erb
@@ -115,14 +115,15 @@
     <span class="hidden-xs-custom"><%= t("repositories.edit_record") %></span>
   </button>
 
-  <!-- Don't check if user can manage the selected repository records, because the ones that he can't, will be left untouched -->
-  <button type="button" class="btn btn-default"
-    id="deleteRepositoryRecordsButton" data-target="#deleteRepositoryRecord" data-toggle="modal" disabled>
-    <span class="glyphicon glyphicon-trash"></span>
-    <span class="hidden-xs-custom"><%= t'repositories.delete_record' %></span>
-      <%= submit_tag I18n.t('repositories.delete_record'), :class => "hidden
-      delete_repository_records_submit" %>
-  </button>
+  <% if can_manage_repository_rows?(repository.team) %>
+    <button type="button" class="btn btn-default"
+      id="deleteRepositoryRecordsButton" data-target="#deleteRepositoryRecord" data-toggle="modal" disabled>
+      <span class="glyphicon glyphicon-trash"></span>
+      <span class="hidden-xs-custom"><%= t'repositories.delete_record' %></span>
+        <%= submit_tag I18n.t('repositories.delete_record'), :class => "hidden
+        delete_repository_records_submit" %>
+    </button>
+  <% end %>
 </div>
 
 <%= render partial: "repositories/repository_table.html.erb",