[#5421] Only bulk assign deliverables to issues when the user has permission

lib/redmine_contracts/hooks/controller_issues_bulk_edit_before_save_hook.rb

@@ -6,6 +6,8 @@ module RedmineContracts
       # * :params => HTML parameters
       #
       def controller_issues_bulk_edit_before_save(context={})
+        return '' unless User.current.allowed_to?(:assign_deliverable_to_issue, context[:issue].project)
+        
         case
         when context[:params][:deliverable_id].blank?
           # Do nothing

test/integration/redmine_contracts/hooks/controller_issues_bulk_edit_before_save_hook_test.rb

@@ -19,12 +19,17 @@ class RedmineContracts::Hooks::ControllerIssuesBulkEditBeforeSaveHookTest < Acti
       @deliverable1 = FixedDeliverable.generate!(:contract => @contract1, :manager => @manager, :title => 'The Title 1')
       @deliverable2 = FixedDeliverable.generate!(:contract => @contract2, :manager => @manager, :title => 'The Title 2')
       @issue.deliverable = @deliverable1
+      @issue.save
 
       login_as('manager', 'existing')
     end
 
     context "when saving multiple issues" do
+
+      context "with permission to Assign Deliverable to Issue" do
         setup do
+          @role.permissions << :assign_deliverable_to_issue
+          @role.save!
           visit_issue_bulk_edit_page(@issues)
         end
 
@@ -49,6 +54,38 @@ class RedmineContracts::Hooks::ControllerIssuesBulkEditBeforeSaveHookTest < Acti
             assert_equal @deliverable2, issue.reload.deliverable
           end
         end
+
+      end
+
+      context "with no permission to Assign Deliverable to Issue" do
+        setup do
+          @role.permissions.delete(:assign_deliverable_to_issue)
+          @role.save!
+          visit_issue_bulk_edit_page(@issues)
+        end
+
+        should "not allow clearing deliverables" do
+          # Simulate form post since the field is hidden
+          post "/issues/bulk_edit", :ids => @issues.collect(&:id), :deliverable_id => 'none'
+
+          assert_response :redirect
+
+          assert_equal @deliverable1, @issue.reload.deliverable
+        end
+        
+        should "not allow assigning a deliverable" do
+          # Simulate form post since the field is hidden
+          post "/issues/bulk_edit", :ids => @issues.collect(&:id), :deliverable_id => @deliverable2.id
+
+          assert_response :redirect
+
+          @issues.each do |issue|
+            assert_not_equal @deliverable2, issue.reload.deliverable
+          end
+        end
+
+      end
+      
     end
   end
 end