[#5421] Only bulk assign deliverables to issues when the user has permission

lib/redmine_contracts/hooks/controller_issues_bulk_edit_before_save_hook.rb

@@ -6,6 +6,8 @@ module RedmineContracts
       # * :params => HTML parameters
       #
       def controller_issues_bulk_edit_before_save(context={})
+        return '' unless User.current.allowed_to?(:assign_deliverable_to_issue, context[:issue].project)
+        
         case
         when context[:params][:deliverable_id].blank?
           # Do nothing

test/integration/redmine_contracts/hooks/controller_issues_bulk_edit_before_save_hook_test.rb

@@ -19,36 +19,73 @@ class RedmineContracts::Hooks::ControllerIssuesBulkEditBeforeSaveHookTest < Acti
       @deliverable1 = FixedDeliverable.generate!(:contract => @contract1, :manager => @manager, :title => 'The Title 1')
       @deliverable2 = FixedDeliverable.generate!(:contract => @contract2, :manager => @manager, :title => 'The Title 2')
       @issue.deliverable = @deliverable1
+      @issue.save
 
       login_as('manager', 'existing')
     end
 
     context "when saving multiple issues" do
-      setup do
-        visit_issue_bulk_edit_page(@issues)
+
+      context "with permission to Assign Deliverable to Issue" do
+        setup do
+          @role.permissions << :assign_deliverable_to_issue
+          @role.save!
+          visit_issue_bulk_edit_page(@issues)
+        end
+
+        should "allow clearing all of the deliverables" do
+          select "none", :from => "Deliverable"
+          click_button "Submit"
+
+          assert_response :success
+
+          @issues.each do |issue|
+            assert_equal nil, issue.reload.deliverable
+          end
+        end
+        
+        should "allow assigning a deliverable" do
+          select @deliverable2.title, :from => "Deliverable"
+          click_button "Submit"
+
+          assert_response :success
+
+          @issues.each do |issue|
+            assert_equal @deliverable2, issue.reload.deliverable
+          end
+        end
+
       end
 
-      should "allow clearing all of the deliverables" do
-        select "none", :from => "Deliverable"
-        click_button "Submit"
-
-        assert_response :success
-
-        @issues.each do |issue|
-          assert_equal nil, issue.reload.deliverable
+      context "with no permission to Assign Deliverable to Issue" do
+        setup do
+          @role.permissions.delete(:assign_deliverable_to_issue)
+          @role.save!
+          visit_issue_bulk_edit_page(@issues)
         end
+
+        should "not allow clearing deliverables" do
+          # Simulate form post since the field is hidden
+          post "/issues/bulk_edit", :ids => @issues.collect(&:id), :deliverable_id => 'none'
+
+          assert_response :redirect
+
+          assert_equal @deliverable1, @issue.reload.deliverable
+        end
+        
+        should "not allow assigning a deliverable" do
+          # Simulate form post since the field is hidden
+          post "/issues/bulk_edit", :ids => @issues.collect(&:id), :deliverable_id => @deliverable2.id
+
+          assert_response :redirect
+
+          @issues.each do |issue|
+            assert_not_equal @deliverable2, issue.reload.deliverable
+          end
+        end
+
       end
       
-      should "allow assigning a deliverable" do
-        select @deliverable2.title, :from => "Deliverable"
-        click_button "Submit"
-
-        assert_response :success
-
-        @issues.each do |issue|
-          assert_equal @deliverable2, issue.reload.deliverable
-        end
-      end
     end
   end
 end