From 1cefd4e851cdbc9ba4bfe1f91ec346ffa4643f56 Mon Sep 17 00:00:00 2001
From: Yohan Boniface <yohanboniface@free.fr>
Date: Fri, 8 Sep 2023 16:44:45 +0200
Subject: [PATCH] Hide create/delete datalayers button + map settings to users
 without rights

---
 umap/static/umap/js/umap.controls.js | 38 ++++++++++++++++++----------
 umap/static/umap/map.css             |  3 +++
 umap/views.py                        |  5 +++-
 3 files changed, 31 insertions(+), 15 deletions(-)

diff --git a/umap/static/umap/js/umap.controls.js b/umap/static/umap/js/umap.controls.js
index 696e7c3f..87baa753 100644
--- a/umap/static/umap/js/umap.controls.js
+++ b/umap/static/umap/js/umap.controls.js
@@ -273,7 +273,12 @@ L.U.ContinueLineAction = L.U.BaseVertexAction.extend({
 })
 
 // Leaflet.Toolbar doesn't allow twice same toolbar class…
-L.U.SettingsToolbar = L.Toolbar.Control.extend({})
+L.U.SettingsToolbar = L.Toolbar.Control.extend({
+  addTo: function (map) {
+    if (map.options.allowMapEdit === false) return
+    L.Toolbar.Control.prototype.addTo.call(this, map)
+  },
+})
 L.U.DrawToolbar = L.Toolbar.Control.extend({
   initialize: function (options) {
     L.Toolbar.Control.prototype.initialize.call(this, options)
@@ -608,21 +613,26 @@ L.U.DataLayer.include({
     edit.title = L._('Edit')
     table.title = L._('Edit properties in a table')
     remove.title = L._('Delete layer')
+    if (this.isReadOnly()) {
+      L.DomUtil.addClass(container, 'readonly')
+    }
+    else {
+      L.DomEvent.on(edit, 'click', this.edit, this)
+      L.DomEvent.on(table, 'click', this.tableEdit, this)
+      L.DomEvent.on(
+        remove,
+        'click',
+        function () {
+          if (!this.isVisible()) return
+          if (!confirm(L._('Are you sure you want to delete this layer?'))) return
+          this._delete()
+          this.map.ui.closePanel()
+        },
+        this
+      )
+    }
     L.DomEvent.on(toggle, 'click', this.toggle, this)
     L.DomEvent.on(zoomTo, 'click', this.zoomTo, this)
-    L.DomEvent.on(edit, 'click', this.edit, this)
-    L.DomEvent.on(table, 'click', this.tableEdit, this)
-    L.DomEvent.on(
-      remove,
-      'click',
-      function () {
-        if (!this.isVisible()) return
-        if (!confirm(L._('Are you sure you want to delete this layer?'))) return
-        this._delete()
-        this.map.ui.closePanel()
-      },
-      this
-    )
     L.DomUtil.addClass(container, this.getHidableClass())
     L.DomUtil.classIf(container, 'off', !this.isVisible())
     container.dataset.id = L.stamp(this)
diff --git a/umap/static/umap/map.css b/umap/static/umap/map.css
index d830fc0a..3ffe7c52 100644
--- a/umap/static/umap/map.css
+++ b/umap/static/umap/map.css
@@ -756,15 +756,18 @@ a.map-name:after {
 .umap-toggle-edit {
     background-position: -44px -48px;
 }
+.readonly .layer-table-edit,
 .off .layer-table-edit {
     background-position: -74px -1px;
 }
+.readonly .layer-edit,
 .off .layer-edit {
     background-position: -51px -72px;
 }
 .off .layer-zoom_to {
     background-position: -25px -54px;
 }
+.readonly .layer-delete,
 .off .layer-delete {
     background-position: -122px -121px;
 }
diff --git a/umap/views.py b/umap/views.py
index 05cf9d5f..e0a15613 100644
--- a/umap/views.py
+++ b/umap/views.py
@@ -449,7 +449,10 @@ class MapDetailMixin:
         properties = {
             "urls": _urls_for_js(),
             "tilelayers": TileLayer.get_list(),
-            "allowEdit": self.is_edit_allowed(),
+            "allowEdit": self.is_edit_allowed(),  # showEditMode
+            "allowMapEdit": self.object.can_edit(self.request.user, self.request)
+            if self.object
+            else True,  # FIXME naming
             "default_iconUrl": "%sumap/img/marker.png" % settings.STATIC_URL,  # noqa
             "umap_id": self.get_umap_id(),
             "starred": self.is_starred(),