Merge pull request #2876 from dunn/GH-2759

dashboard/collections: only allow 'nest collection' when authed
samvera · Apr 1, 2018 · d927d66 · d927d66
2 parents dd8013f + 9c2fcb3
commit d927d66
Show file tree

Hide file tree

Showing 2 changed files with 14 additions and 1 deletion.
diff --git a/app/views/hyrax/dashboard/collections/_show_actions.html.erb b/app/views/hyrax/dashboard/collections/_show_actions.html.erb
@@ -7,7 +7,7 @@
                 data: { turbolinks: false } %>
 <% end %>
 
-<% if presenter.collection_type_is_nestable? %>
+<% if presenter.collection_type_is_nestable? && presenter.user_can_nest_collection? %>
 <!-- The user should have deposit access to the parent and read access to the child (the collection we are already showing, so no test is necessary). -->
     <%= button_tag '',
                   class: 'btn btn-primary add-to-collection',

diff --git a/spec/views/hyrax/dashboard/collections/_show_actions.html.erb_spec.rb b/spec/views/hyrax/dashboard/collections/_show_actions.html.erb_spec.rb
@@ -35,10 +35,23 @@
     context 'with nestable collection' do
       it 'renders add parent collection link' do
         allow(presenter).to receive(:collection_type_is_nestable?).and_return true
+        allow(presenter).to receive(:user_can_nest_collection?).and_return true
+
         render
         expect(rendered).to have_button('Add existing collections to this collection')
       end
     end
+
+    context 'with nestable collection but without permissions' do
+      it 'does not render add parent collection link' do
+        allow(presenter).to receive(:collection_type_is_nestable?).and_return true
+        allow(presenter).to receive(:user_can_nest_collection?).and_return false
+
+        render
+        expect(rendered).not_to have_button('Add existing collections to this collection')
+      end
+    end
+
     context 'with non-nestable collection' do
       it 'does not render add parent collection link' do
         render