From d3bf9fcdf0c70c179a489e7773aebf47d020bd8f Mon Sep 17 00:00:00 2001
From: Yohan Boniface <yohanboniface@free.fr>
Date: Tue, 16 Apr 2024 11:32:00 +0200
Subject: [PATCH] fix: hide delete button for editors in dashboard

fix #1739
---
 umap/templates/umap/map_table.html       |  2 ++
 umap/templatetags/umap_tags.py           |  5 +++++
 umap/tests/integration/test_dashboard.py | 10 ++++++++++
 3 files changed, 17 insertions(+)

diff --git a/umap/templates/umap/map_table.html b/umap/templates/umap/map_table.html
index 51d01543..b619540e 100644
--- a/umap/templates/umap/map_table.html
+++ b/umap/templates/umap/map_table.html
@@ -68,6 +68,7 @@
                   <span class="sr-only">{% translate "Clone" %}</span>
                 </button>
               </form>
+              {% if map_inst|can_delete_map:request %}
               <form action="{% url 'map_delete' map_inst.pk %}"
                     method="post"
                     class="map-delete">
@@ -78,6 +79,7 @@
                   <span class="sr-only">{% translate "Delete" %}</span>
                 </button>
               </form>
+              {% endif %}
             </td>
           </tr>
         {% endwith %}
diff --git a/umap/templatetags/umap_tags.py b/umap/templatetags/umap_tags.py
index aa7a45c0..9e776637 100644
--- a/umap/templatetags/umap_tags.py
+++ b/umap/templatetags/umap_tags.py
@@ -43,6 +43,11 @@ def tilelayer_preview(tilelayer):
     return output
 
 
+@register.filter
+def can_delete_map(map, request):
+    return map.can_delete(request.user, request)
+
+
 @register.filter
 def notag(s):
     return s.replace("<", "&lt;")
diff --git a/umap/tests/integration/test_dashboard.py b/umap/tests/integration/test_dashboard.py
index 0355eb67..86e8ff78 100644
--- a/umap/tests/integration/test_dashboard.py
+++ b/umap/tests/integration/test_dashboard.py
@@ -36,3 +36,13 @@ def test_dashboard_map_preview(map, live_server, datalayer, login):
     expect(dialog).to_be_visible()
     # Let's check we have a marker on it, so we can guess the map loaded correctly
     expect(dialog.locator(".leaflet-marker-icon")).to_be_visible()
+
+
+def test_no_delete_button_for_editors(map, live_server, datalayer, login, user):
+    map.name = "Map I cannot delete"
+    map.editors.add(user)
+    map.save()
+    page = login(user)
+    page.goto(f"{live_server.url}/en/me")
+    expect(page.get_by_text("Map I cannot delete")).to_be_visible()
+    expect(page.get_by_title("Delete")).to_be_hidden()