Authoritative source button should not show if user does not have permission

#327

Author: davidwatkins73

waltz-ng/client/auth-sources/edit.js

@@ -88,8 +88,14 @@ function editController($state,
             };
             authSourceStore
                 .insert(insertRequest)
-                .then(refresh)
-                .then(() => notification.success('Authoritative Sources updated'));
+                .then(
+                    () => notification.success('Authoritative Sources updated'),
+                    (e) => {
+                        console.log('err', e);
+                        notification.error('Update failed, ' + e.data.message || e.statusText);
+                    }
+                )
+                .then(refresh);
         }
     }
 

waltz-ng/client/org-units/unit-view.html

@@ -78,13 +78,14 @@
     <!-- AUTH-FLOWS -->
     <waltz-section name="Authoritative Sources"
                    id="flows-section">
-        <waltz-section-actions >
-            <a waltz-has-role="AUTHORITATIVE_SOURCE_EDITOR"
-               ng-if="ctrl.showAuthSourceEditBtn"
-               ui-sref="main.auth-sources.edit (ctrl.entityRef)"
-               class="btn btn-xs btn-primary">
-                Edit
-            </a>
+        <waltz-section-actions>
+            <span waltz-has-role="AUTHORITATIVE_SOURCE_EDITOR">
+                <a ng-if="ctrl.showAuthSourceEditBtn"
+                   ui-sref="main.auth-sources.edit (ctrl.entityRef)"
+                   class="btn btn-xs btn-primary">
+                    Edit
+                </a>
+            </span>
             <button class="btn btn-xs waltz-btn-transparent"
                     ng-click="ctrl.visibility.authOverlay = ! ctrl.visibility.authOverlay">
                 <waltz-icon name="map-signs"></waltz-icon>

waltz-web/src/main/java/com/khartec/waltz/web/endpoints/api/AuthoritativeSourceEndpoint.java

@@ -24,8 +24,10 @@
 import com.khartec.waltz.model.authoritativesource.Rating;
 import com.khartec.waltz.model.changelog.ChangeLog;
 import com.khartec.waltz.model.changelog.ImmutableChangeLog;
+import com.khartec.waltz.model.user.Role;
 import com.khartec.waltz.service.authoritative_source.AuthoritativeSourceService;
 import com.khartec.waltz.service.changelog.ChangeLogService;
+import com.khartec.waltz.service.user.UserRoleService;
 import com.khartec.waltz.web.endpoints.Endpoint;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Service;
@@ -44,16 +46,20 @@ public class AuthoritativeSourceEndpoint implements Endpoint {
 
     private final AuthoritativeSourceService authoritativeSourceService;
     private final ChangeLogService changeLogService;
+    private final UserRoleService userRoleService;
 
 
     @Autowired
     public AuthoritativeSourceEndpoint(
             AuthoritativeSourceService authoritativeSourceService,
+            UserRoleService userRoleService,
             ChangeLogService changeLogService) {
         checkNotNull(authoritativeSourceService, "authoritativeSourceService must not be null");
+        checkNotNull(userRoleService, "userRoleService cannot be null");
         checkNotNull(changeLogService, "changeLogService must not be null");
 
         this.authoritativeSourceService = authoritativeSourceService;
+        this.userRoleService = userRoleService;
         this.changeLogService = changeLogService;
     }
 
@@ -70,13 +76,15 @@ public void register() {
                 -> authoritativeSourceService.findByApplicationId(getId(request)));
 
         post(mkPath(BASE_URL, "id", ":id"), (request, response) -> {
+            requireRole(userRoleService, request, Role.AUTHORITATIVE_SOURCE_EDITOR);
             String ratingStr = request.body();
             Rating rating = Rating.valueOf(ratingStr);
             authoritativeSourceService.update(getId(request), rating);
             return "done";
         });
 
         delete(mkPath(BASE_URL, "id", ":id"), (request, response) -> {
+            requireRole(userRoleService, request, Role.AUTHORITATIVE_SOURCE_EDITOR);
             long id = getId(request);
             AuthoritativeSource authSource = authoritativeSourceService.getById(id);
             if (authSource == null) {
@@ -103,6 +111,7 @@ public void register() {
         });
 
         post(mkPath(BASE_URL, "kind", ":kind", ":id", ":dataType", ":appId"), (request, response) -> {
+            requireRole(userRoleService, request, Role.AUTHORITATIVE_SOURCE_EDITOR);
             EntityReference parentRef = getEntityReference(request);
             String dataType = request.params("dataType");
             Long appId = getLong(request, "appId");