From 9c2fcb384c15d194fea767c76592cea02ee29772 Mon Sep 17 00:00:00 2001
From: Alex Dunn <dunn.alex@gmail.com>
Date: Fri, 30 Mar 2018 10:28:59 -0700
Subject: [PATCH] dashboard/collections: only allow 'nest collection' when
 authed

Fixes GH-2759.
---
 .../dashboard/collections/_show_actions.html.erb    |  2 +-
 .../collections/_show_actions.html.erb_spec.rb      | 13 +++++++++++++
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/app/views/hyrax/dashboard/collections/_show_actions.html.erb b/app/views/hyrax/dashboard/collections/_show_actions.html.erb
index d466f0c26d..a4de85bf3f 100644
--- a/app/views/hyrax/dashboard/collections/_show_actions.html.erb
+++ b/app/views/hyrax/dashboard/collections/_show_actions.html.erb
@@ -7,7 +7,7 @@
                 data: { turbolinks: false } %>
 <% end %>
 
-<% if presenter.collection_type_is_nestable? %>
+<% if presenter.collection_type_is_nestable? && presenter.user_can_nest_collection? %>
 <!-- The user should have deposit access to the parent and read access to the child (the collection we are already showing, so no test is necessary). -->
     <%= button_tag '',
                   class: 'btn btn-primary add-to-collection',
diff --git a/spec/views/hyrax/dashboard/collections/_show_actions.html.erb_spec.rb b/spec/views/hyrax/dashboard/collections/_show_actions.html.erb_spec.rb
index 7540bbae53..2c541611b6 100644
--- a/spec/views/hyrax/dashboard/collections/_show_actions.html.erb_spec.rb
+++ b/spec/views/hyrax/dashboard/collections/_show_actions.html.erb_spec.rb
@@ -35,10 +35,23 @@
     context 'with nestable collection' do
       it 'renders add parent collection link' do
         allow(presenter).to receive(:collection_type_is_nestable?).and_return true
+        allow(presenter).to receive(:user_can_nest_collection?).and_return true
+
         render
         expect(rendered).to have_button('Add existing collections to this collection')
       end
     end
+
+    context 'with nestable collection but without permissions' do
+      it 'does not render add parent collection link' do
+        allow(presenter).to receive(:collection_type_is_nestable?).and_return true
+        allow(presenter).to receive(:user_can_nest_collection?).and_return false
+
+        render
+        expect(rendered).not_to have_button('Add existing collections to this collection')
+      end
+    end
+
     context 'with non-nestable collection' do
       it 'does not render add parent collection link' do
         render