From a4b137172930ba1f8e1d576ff5ff5dd189a72b1a Mon Sep 17 00:00:00 2001
From: Marko Haarni <marko.haarni@gofore.com>
Date: Fri, 6 Oct 2023 16:43:32 +0300
Subject: [PATCH] HAI-1947 Show buttons in application view according to user
 permissions (#381)

Show Edit application and Cancel application buttons if user has
Kaikki oikeudet, Hankkeen ja hakemuksen muokkaus or Hakemusasiointi
permission for the hanke.
---
 .../applicationView/ApplicationView.test.tsx  | 30 +++++++++++++++---
 .../applicationView/ApplicationView.tsx       | 31 +++++++++++--------
 .../hanke/hankeUsers/UserRightsCheck.tsx      |  2 +-
 3 files changed, 45 insertions(+), 18 deletions(-)

diff --git a/src/domain/application/applicationView/ApplicationView.test.tsx b/src/domain/application/applicationView/ApplicationView.test.tsx
index f445694a2..838975d73 100644
--- a/src/domain/application/applicationView/ApplicationView.test.tsx
+++ b/src/domain/application/applicationView/ApplicationView.test.tsx
@@ -1,9 +1,10 @@
 import React from 'react';
 import { rest } from 'msw';
-import { render, screen } from '../../../testUtils/render';
+import { render, screen, waitFor } from '../../../testUtils/render';
 import ApplicationViewContainer from './ApplicationViewContainer';
 import { waitForLoadingToFinish } from '../../../testUtils/helperFunctions';
 import { server } from '../../mocks/test-server';
+import { SignedInUser } from '../../hanke/hankeUsers/hankeUser';
 
 test('Correct information about application should be displayed', async () => {
   render(<ApplicationViewContainer id={4} />);
@@ -56,7 +57,7 @@ test('Should show error notification if loading application fails', async () =>
 test('Should be able to go editing application when editing is possible', async () => {
   const { user } = render(<ApplicationViewContainer id={4} />);
 
-  await waitForLoadingToFinish();
+  await waitFor(() => screen.findByRole('button', { name: 'Muokkaa hakemusta' }));
   await user.click(screen.getByRole('button', { name: 'Muokkaa hakemusta' }));
 
   expect(window.location.pathname).toBe('/fi/johtoselvityshakemus/4/muokkaa');
@@ -73,8 +74,7 @@ test('Application edit button should not be displayed when editing is not possib
 test('Should be able to cancel application if it is possible', async () => {
   const { user } = render(<ApplicationViewContainer id={4} />);
 
-  await waitForLoadingToFinish();
-
+  await waitFor(() => screen.findByRole('button', { name: 'Peru hakemus' }));
   await user.click(screen.getByRole('button', { name: 'Peru hakemus' }));
   await user.click(screen.getByRole('button', { name: 'Vahvista' }));
 
@@ -90,3 +90,25 @@ test('Should not be able to cancel application if it has moved to handling in Al
 
   expect(screen.queryByRole('button', { name: 'Peru hakemus' })).not.toBeInTheDocument();
 });
+
+test('Should not show Edit application and Cancel application buttons if user does not have EDIT_APPLICATIONS permission', async () => {
+  server.use(
+    rest.get('/api/hankkeet/:hankeTunnus/whoami', async (req, res, ctx) => {
+      return res(
+        ctx.status(200),
+        ctx.json<SignedInUser>({
+          hankeKayttajaId: '3fa85f64-5717-4562-b3fc-2c963f66afa6',
+          kayttooikeustaso: 'KATSELUOIKEUS',
+          kayttooikeudet: ['VIEW'],
+        }),
+      );
+    }),
+  );
+
+  render(<ApplicationViewContainer id={4} />);
+
+  await waitForLoadingToFinish();
+
+  expect(screen.queryByRole('button', { name: 'Muokkaa hakemusta' })).not.toBeInTheDocument();
+  expect(screen.queryByRole('button', { name: 'Peru hakemus' })).not.toBeInTheDocument();
+});
diff --git a/src/domain/application/applicationView/ApplicationView.tsx b/src/domain/application/applicationView/ApplicationView.tsx
index 2066e6717..542c89730 100644
--- a/src/domain/application/applicationView/ApplicationView.tsx
+++ b/src/domain/application/applicationView/ApplicationView.tsx
@@ -38,6 +38,7 @@ import { ApplicationCancel } from '../components/ApplicationCancel';
 import AttachmentSummary from '../components/AttachmentSummary';
 import useAttachments from '../hooks/useAttachments';
 import FeatureFlags from '../../../common/components/featureFlags/FeatureFlags';
+import UserRightsCheck from '../../hanke/hankeUsers/UserRightsCheck';
 
 type Props = {
   application: Application;
@@ -119,21 +120,25 @@ function ApplicationView({ application, hanke, onEditApplication }: Props) {
 
         <InformationViewHeaderButtons>
           {isPending ? (
-            <Button
-              theme="coat"
-              iconLeft={<IconPen aria-hidden="true" />}
-              onClick={onEditApplication}
-            >
-              {t('hakemus:buttons:editApplication')}
-            </Button>
+            <UserRightsCheck requiredRight="EDIT_APPLICATIONS" hankeTunnus={hanke?.hankeTunnus}>
+              <Button
+                theme="coat"
+                iconLeft={<IconPen aria-hidden="true" />}
+                onClick={onEditApplication}
+              >
+                {t('hakemus:buttons:editApplication')}
+              </Button>
+            </UserRightsCheck>
           ) : null}
           {hanke ? (
-            <ApplicationCancel
-              applicationId={id}
-              alluStatus={alluStatus}
-              hankeTunnus={hanke?.hankeTunnus}
-              buttonIcon={<IconTrash aria-hidden />}
-            />
+            <UserRightsCheck requiredRight="EDIT_APPLICATIONS" hankeTunnus={hanke?.hankeTunnus}>
+              <ApplicationCancel
+                applicationId={id}
+                alluStatus={alluStatus}
+                hankeTunnus={hanke?.hankeTunnus}
+                buttonIcon={<IconTrash aria-hidden />}
+              />
+            </UserRightsCheck>
           ) : null}
         </InformationViewHeaderButtons>
       </InformationViewHeader>
diff --git a/src/domain/hanke/hankeUsers/UserRightsCheck.tsx b/src/domain/hanke/hankeUsers/UserRightsCheck.tsx
index 910576e64..a138d0936 100644
--- a/src/domain/hanke/hankeUsers/UserRightsCheck.tsx
+++ b/src/domain/hanke/hankeUsers/UserRightsCheck.tsx
@@ -14,7 +14,7 @@ function UserRightsCheck({
   /** User right that is required to render children */
   requiredRight: keyof typeof Rights;
   /** hankeTunnus of the hanke that the right is required for */
-  hankeTunnus: string;
+  hankeTunnus?: string;
   children: React.ReactElement;
 }) {
   const { data: signedInUser } = useUserRightsForHanke(hankeTunnus);