bterkuile/fizzy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Disable board edit buttons for select all/none when not privileged

Browse Source 
ref: https://github.com/basecamp/fizzy/discussions/1992
This commit is contained in:
Mike Dalessio
2025-12-08 13:21:52 -05:00
parent cf6d3e2361
commit 48730d67e0
3 changed files with 27 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/views/boards/_access_toggle.erb → app/views/boards/_access_toggle.html.erb
View File
app/views/boards/edit/_users.html.erb
+6 -5
View File
@@ -1,3 +1,4 @@
<% disabled = !Current.user.can_administer_board?(board) %>
<header>
<h2 class="divider txt-medium margin-block-start">Who can access this board?</h2>
</header>
@@ -16,7 +17,7 @@
<hr class="separator--horizontal flex-item-grow" style="--border-color: var(--color-ink-medium); --border-style: dashed" aria-hidden="true" />
<label for="board_all_access" class="switch">
<%= form.check_box :all_access, class: "switch__input", checked: board.all_access?, disabled: !Current.user.can_administer_board?(board), data: { action: "change->toggle-class#toggle" } %>
<%= form.check_box :all_access, class: "switch__input", checked: board.all_access?, disabled:, data: { action: "change->toggle-class#toggle" } %>
<span class="switch__btn round"></span>
<span class="for-screen-reader">Give everyone access to this board</span>
</label>
@@ -26,14 +27,14 @@
<div class="toggler__visible-when-off">
<div class="flex align-center justify-end gap-half">
<button type="button" class="btn btn--plain txt-x-small txt-link font-weight-normal" data-action="click->toggle-class#checkAll">Select all</button>
<%= button_tag "Select all", type: "button", class: "btn btn--plain txt-x-small txt-link font-weight-normal", data: { action: "click->toggle-class#checkAll" }, disabled: %>
<span class="txt-subtle">&middot;</span>
<button type="button" class="btn btn--plain txt-x-small txt-link font-weight-normal" data-action="click->toggle-class#checkNone">Select none</button>
<%= button_tag "Select none", type: "button", class: "btn btn--plain txt-x-small txt-link font-weight-normal", data: { action: "click->toggle-class#checkNone" }, disabled: %>
</div>
</div>
<ul class="settings__user-list" data-filter-target="list">
<%= access_toggles_for selected_users, selected: true, disabled: !Current.user.can_administer_board?(board) %>
<%= access_toggles_for unselected_users, selected: false, disabled: !Current.user.can_administer_board?(board) %>
<%= access_toggles_for selected_users, selected: true, disabled: %>
<%= access_toggles_for unselected_users, selected: false, disabled: %>
</ul>
<% end %>
test/controllers/boards_controller_test.rb
+21
View File
@@ -145,4 +145,25 @@ class BoardsControllerTest < ActionDispatch::IntegrationTest
assert_response :forbidden
end
test "disables select all/none buttons for non-privileged user" do
logout_and_sign_in_as :jz
assert_not users(:jz).can_administer_board?(boards(:writebook))
get edit_board_path(boards(:writebook))
assert_response :success
assert_select "button[disabled]", text: "Select all"
assert_select "button[disabled]", text: "Select none"
end
test "enables select all/none buttons for privileged user" do
assert users(:kevin).can_administer_board?(boards(:writebook))
get edit_board_path(boards(:writebook))
assert_response :success
assert_select "button:not([disabled])", text: "Select all"
assert_select "button:not([disabled])", text: "Select none"
end
end