Limiting user actions in backlog

app/coffee/modules/backlog/main.coffee

@@ -707,6 +707,12 @@ UsPointsDirective = ($repo) ->
                     $repo.refresh(us).then ->
                         $ctrl.loadProjectStats()
 
+        taiga.bindOnce $scope, "project", (project) ->
+            # If the user has not enough permissions the click events are unbinded
+            if project.my_permissions.indexOf("modify_us") == -1
+                $el.unbind("click")
+                $el.find("a").addClass("not-clickable")
+
         $scope.$on "$destroy", ->
             $el.off()
 

app/coffee/modules/common.coffee

@@ -340,3 +340,30 @@ ChangeDirective = ->
     return {link:link, require:"ngModel"}
 
 module.directive("tgChange", ChangeDirective)
+
+
+#############################################################################
+## Permission directive, hide elements when necessary
+#############################################################################
+
+CheckPermissionDirective = ->
+    showElementIfPermission = (element, permission, project) ->
+        element.show() if project.my_permissions.indexOf(permission) > -1
+
+    link = ($scope, $el, $attrs) ->
+        $el.hide()
+        permission = $attrs.permission
+
+        #Sometimes this directive from a self included html template
+        if $scope.project?
+            showElementIfPermission($el, permission, $scope.project)
+
+        $scope.$on "project:loaded", (ctx, project) ->
+            showElementIfPermission($el, permission, project)
+
+        $scope.$on "$destroy", ->
+            $el.off()
+
+    return {link:link}
+
+module.directive("tgCheckPermission", CheckPermissionDirective)

app/coffee/modules/common/popovers.coffee

@@ -64,10 +64,6 @@ UsStatusDirective = ($repo) ->
         $ctrl = $el.controller()
         us = $scope.$eval($attrs.tgUsStatus)
 
-        taiga.bindOnce $scope, "project", (project) ->
-            $el.append(selectionTemplate({ 'statuses':  project.us_statuses }))
-            updateUsStatus($el, us, $scope.usStatusById)
-
         $el.on "click", ".us-status", (event) ->
             event.preventDefault()
             event.stopPropagation()
@@ -90,6 +86,15 @@ UsStatusDirective = ($repo) ->
                 $repo.save(us).then ->
                     $scope.$eval($attrs.onUpdate)
 
+        taiga.bindOnce $scope, "project", (project) ->
+            $el.append(selectionTemplate({ 'statuses':  project.us_statuses }))
+            updateUsStatus($el, us, $scope.usStatusById)
+
+            # If the user has not enough permissions the click events are unbinded
+            if project.my_permissions.indexOf("modify_us") == -1
+                $el.unbind("click")
+                $el.find("a").addClass("not-clickable")
+
         $scope.$on "$destroy", ->
             $el.off()
 

app/partials/views/components/addnewus.jade

@@ -1,5 +1,5 @@
 div.new-us
-    a.button.button-green(href="", ng-click="ctrl.addNewUs('standard')", title="Add New US")
+    a.button.button-green(tg-check-permission, permission="add_us", href="", ng-click="ctrl.addNewUs('standard')", title="Add New US")
         span.text + Add new US
-    a.button.button-bulk(href="", ng-click="ctrl.addNewUs('bulk')", title="Bulk")
+    a.button.button-bulk(tg-check-permission, permission="add_us", href="", ng-click="ctrl.addNewUs('bulk')", title="Bulk")
         span.icon.icon-bulk

app/partials/views/components/backlog-row.jade

@@ -3,20 +3,20 @@ div.row.us-item-row(ng-repeat="us in visibleUserstories|orderBy:order track by u
         div.user-story-tags
             span.tag(ng-repeat="tag in us.tags", tg-bind-html="tag", tg-colorize-tag="tag")
         div.user-story-name
-            input(type="checkbox", name="")
+            input(tg-check-permission, permission="modify_us", type="checkbox", name="")
             a.clickable(tg-nav="project-userstories-detail:project=project.slug,ref=us.ref", title="{{ us.subject }}") {{ us.subject }}
             span.us-settings
-                a.icon.icon-edit(href="", ng-click="ctrl.editUserStory(us)", title="Edit")
+                a.icon.icon-edit(tg-check-permission, permission="modify_us", href="", ng-click="ctrl.editUserStory(us)", title="Edit")
-                a.icon.icon-delete(href="", ng-click="ctrl.deleteUserStory(us)", title="Delete")
+                a.icon.icon-delete(tg-check-permission, permission="delete_us", href="", ng-click="ctrl.deleteUserStory(us)", title="Delete")
 
     div.status(tg-us-status="us" on-update="ctrl.loadProjectStats()")
         a.us-status(href="", title="Status Name")
             span.us-status-bind
-            span.icon.icon-arrow-bottom
+            span.icon.icon-arrow-bottom(tg-check-permission, permission="modify_us")
 
     div.points(tg-us-points="us")
         a.us-points(href="", title="Points")
             span.points-value 0
-            span.icon.icon-arrow-bottom
+            span.icon.icon-arrow-bottom(tg-check-permission, permission="modify_us")
 
-    a.icon.icon-drag-v(href="", title="Drag")
+    a.icon.icon-drag-v(tg-check-permission, permission="modify_us", href="", title="Drag")

app/partials/views/modules/lightbox_add-edit-sprint.jade

@@ -10,5 +10,6 @@ form
         input.date-end(tg-date-selector, ng-model="sprint.estimated_finish", type="text", placeholder="Estimated End", data-required="true")
     a.button.button-green(href="", title="Save")
         span Create
-    span.delete-sprint.hidden Do you want to delete this sprint?
+    div(tg-check-permission, permission="delete_milestone")
-        a.icon.icon-delete(href="", title="delete sprint")
+        span.delete-sprint.hidden Do you want to delete this sprint?
+            a.icon.icon-delete(href="", title="delete sprint")

app/partials/views/modules/sprints.jade

@@ -7,7 +7,7 @@ section.sprints
                     span.number(tg-bind-html="sprintsCounter") --
                     span.description <br/>sprints
             div.new-sprint
-              a.button.button-green(ng-click="ctrl.addNewSprint()", href="", title="Add New US")
+              a.button.button-green(tg-check-permission, permission="add_milestone", ng-click="ctrl.addNewSprint()", href="", title="Add New sprint")
                 span.text + New sprint
 
     section.sprint(ng-repeat="sprint in sprints track by sprint.id"
@@ -16,7 +16,7 @@ section.sprints
             div.sprint-name
                 a.icon.icon-arrow-up(href="", title="compact Sprint")
                 span {{ sprint.name }}
-                a.icon.icon-edit(href="", title="Edit Sprint")
+                a.icon.icon-edit(tg-check-permission, permission="modify_milestone", href="", title="Edit Sprint")
             div.sprint-summary
                 div.sprint-date(tg-date-range="sprint.estimated_start,sprint.estimated_finish")
                 ul
@@ -35,6 +35,6 @@ section.sprints
                         span(tg-bo-ref="us.ref")
                         span(tg-bo-bind="us.subject")
                 div.column-points.width-1(tg-bo-bind="us.total_points")
-        a.button.button-gray(href="", tg-nav="project-taskboard:project=project.slug,sprint=sprint.id",
+        a.button.button-gray(tg-check-permission, permission="view_milestones", title="Current Sprint Taskboard"
-                             title="Current Sprint Taskboard")
+                             href="", tg-nav="project-taskboard:project=project.slug,sprint=sprint.id")
             span Sprint Taskboard

app/styles/dependencies/elements.scss

@@ -38,6 +38,10 @@ ol { list-style: decimal; }
     cursor: pointer;
 }
 
+.not-clickable {
+    cursor: default;
+}
+
 .draggable {
     cursor: move;
 }