Make sure to select only editable layers for attachin to features

umap/static/umap/js/umap.js

@@ -1310,14 +1310,14 @@ L.U.Map.include({
     datalayer = this.lastUsedDataLayer
     if (
       datalayer &&
-      !datalayer.isRemoteLayer() &&
+      !datalayer.isReadOnly() &&
       datalayer.canBrowse() &&
       datalayer.isVisible()
     ) {
       return datalayer
     }
     datalayer = this.findDataLayer((datalayer) => {
-      if (!datalayer.isRemoteLayer() && datalayer.canBrowse()) {
+      if (!datalayer.isReadOnly() && datalayer.canBrowse()) {
         fallback = datalayer
         if (datalayer.isVisible()) return true
       }

umap/tests/base.py

@@ -2,6 +2,7 @@ import json
 
 import factory
 from django.contrib.auth import get_user_model
+from django.core.files.base import ContentFile
 from django.urls import reverse
 
 from umap.forms import DEFAULT_CENTER
@@ -9,6 +10,25 @@ from umap.models import DataLayer, Licence, Map, TileLayer
 
 User = get_user_model()
 
+DATALAYER_DATA = {
+    "type": "FeatureCollection",
+    "features": [
+        {
+            "type": "Feature",
+            "geometry": {
+                "type": "Point",
+                "coordinates": [13.68896484375, 48.55297816440071],
+            },
+            "properties": {
+                "_umap_options": {"color": "DarkCyan", "iconClass": "Ball"},
+                "name": "Here",
+                "description": "Da place anonymous again 755",
+            },
+        }
+    ],
+    "_umap_options": {"displayOnLoad": True, "name": "Donau", "id": 926},
+}
+
 
 class LicenceFactory(factory.django.DjangoModelFactory):
     name = "WTFPL"
@@ -82,10 +102,16 @@ class DataLayerFactory(factory.django.DjangoModelFactory):
     name = "test datalayer"
     description = "test description"
     display_on_load = True
-    settings = {"displayOnLoad": True, "browsable": True, name: "test datalayer"}
+    settings = {"displayOnLoad": True, "browsable": True, "name": "test datalayer"}
-    geojson = factory.django.FileField(
+    geojson = factory.django.FileField()
-        data="""{"type":"FeatureCollection","features":[{"type":"Feature","geometry":{"type":"Point","coordinates":[13.68896484375,48.55297816440071]},"properties":{"_umap_options":{"color":"DarkCyan","iconClass":"Ball"},"name":"Here","description":"Da place anonymous again 755"}}],"_umap_options":{"displayOnLoad":true,"name":"Donau","id":926}}"""
+
-    )  # noqa
+    @factory.post_generation
+    def geojson_data(obj, create, extracted, **kwargs):
+        data = DATALAYER_DATA.copy()
+        obj.settings["name"] = obj.name
+        data["_umap_options"] = obj.settings
+        with open(obj.geojson.path, mode="w") as truc:
+            truc.write(json.dumps(data))
 
     class Meta:
         model = DataLayer

umap/tests/conftest.py

@@ -74,7 +74,7 @@ def allow_anonymous(settings):
 
 @pytest.fixture
 def datalayer(map):
-    return DataLayerFactory(map=map, name="Default Datalayer")
+    return DataLayerFactory(map=map)
 
 
 @pytest.fixture

umap/tests/integration/test_anonymous_owned_map.py

@@ -1,9 +1,13 @@
+import re
+
 import pytest
 from django.core.signing import get_cookie_signer
 from playwright.sync_api import expect
 
 from umap.models import DataLayer
 
+from ..base import DataLayerFactory
+
 pytestmark = [pytest.mark.django_db, pytest.mark.usefixtures("allow_anonymous")]
 
 
@@ -77,5 +81,34 @@ def test_owner_permissions_form(map, datalayer, live_server, owner_session):
     expect(owner_field).to_be_hidden()
     editors_field = owner_session.locator(".umap-field-editors input")
     expect(editors_field).to_be_hidden()
-    datalayer_label = owner_session.get_by_text('Who can edit "Donau"')
+    datalayer_label = owner_session.get_by_text('Who can edit "test datalayer"')
     expect(datalayer_label).to_be_visible()
+
+
+def test_anonymous_can_add_marker_on_editable_layer(
+    anonymap, datalayer, live_server, page
+):
+    datalayer.edit_status = DataLayer.OWNER
+    datalayer.name = "Should not be in the select"
+    datalayer.save()  # Non editable by anonymous users
+    assert datalayer.map == anonymap
+    other = DataLayerFactory(map=anonymap, edit_status=DataLayer.ANONYMOUS, name="Editable")
+    assert other.map == anonymap
+    page.goto(f"{live_server.url}{anonymap.get_absolute_url()}?edit")
+    add_marker = page.get_by_title("Draw a marker")
+    expect(add_marker).to_be_visible()
+    marker = page.locator(".leaflet-marker-icon")
+    map_el = page.locator("#map")
+    expect(marker).to_have_count(2)
+    expect(map_el).not_to_have_class(re.compile("umap-ui"))
+    add_marker.click()
+    map_el.click(position={"x": 100, "y": 100})
+    expect(marker).to_have_count(3)
+    # Edit panel is open
+    expect(map_el).to_have_class(re.compile("umap-ui"))
+    datalayer_select = page.locator("select[name='datalayer']")
+    expect(datalayer_select).to_be_visible()
+    options = page.locator("select[name='datalayer'] option")
+    expect(options).to_have_count(1)  # Only Editable layer should be listed
+    option = page.locator("select[name='datalayer'] option:checked")
+    expect(option).to_have_text(other.name)

umap/tests/integration/test_owned_map.py

@@ -86,7 +86,7 @@ def test_owner_permissions_form(map, datalayer, live_server, login):
     expect(owner_field).to_be_visible()
     editors_field = page.locator(".umap-field-editors input")
     expect(editors_field).to_be_visible()
-    datalayer_label = page.get_by_text('Who can edit "Donau"')
+    datalayer_label = page.get_by_text('Who can edit "test datalayer"')
     expect(datalayer_label).to_be_visible()
 
 
@@ -127,7 +127,7 @@ def test_permissions_form_with_editor(map, datalayer, live_server, login, user):
     expect(owner_field).to_be_hidden()
     editors_field = page.locator(".umap-field-editors input")
     expect(editors_field).to_be_visible()
-    datalayer_label = page.get_by_text('Who can edit "Donau"')
+    datalayer_label = page.get_by_text('Who can edit "test datalayer"')
     expect(datalayer_label).to_be_visible()