feat(permissions): filter fields in forms based on read/write permissions

src/app/core/common-components/entity-form/entity-form.service.spec.ts

@@ -108,6 +108,26 @@ describe("EntityFormService", () => {
     expect(formGroup.valid).toBeTrue();
   });
 
+  it("should use create permissions to disable fields when creating a new entity", () => {
+    const formFields = [{ id: "name" }, { id: "dateOfBirth" }];
+    TestBed.inject(EntityAbility).update([
+      { subject: "Child", action: "read", fields: ["name", "dateOfBirth"] },
+      { subject: "Child", action: "update", fields: ["name"] },
+      { subject: "Child", action: "create", fields: ["dateOfBirth"] },
+    ]);
+
+    const formGroup = service.createFormGroup(
+      formFields,
+      new Child(),
+      false,
+      true,
+      true,
+    );
+
+    expect(formGroup.get("name").disabled).toBeTrue();
+    expect(formGroup.get("dateOfBirth").enabled).toBeTrue();
+  });
+
   it("should always keep properties disabled if user does not have 'update' permissions for them", () => {
     const formFields = [{ id: "name" }, { id: "dateOfBirth" }];
     TestBed.inject(EntityAbility).update([

src/app/core/common-components/entity-form/entity-form.service.ts

@@ -113,12 +113,14 @@ export class EntityFormService {
    * @param entity
    * @param forTable
    * @param withPermissionCheck if true, fields without 'update' permissions will stay disabled when enabling form
+   * @param creatingNew if true, fields without 'create' permissions will stay disabled initially
    */
   public createFormGroup<T extends Entity>(
     formFields: ColumnConfig[],
     entity: T,
     forTable = false,
     withPermissionCheck = true,
+    creatingNew = false,
   ): EntityForm<T> {
     const formConfig = {};
     const copy = entity.copy();
@@ -138,10 +140,12 @@ export class EntityFormService {
     this.subscriptions.push(valueChangesSubscription);
 
     if (withPermissionCheck) {
-      this.disableReadOnlyFormControls(group, entity);
+      this.disableReadOnlyFormControls(group, entity, creatingNew);
       const statusChangesSubscription = group.statusChanges
         .pipe(filter((status) => status !== "DISABLED"))
-        .subscribe(() => this.disableReadOnlyFormControls(group, entity));
+        .subscribe(() =>
+          this.disableReadOnlyFormControls(group, entity, creatingNew),
+        );
       this.subscriptions.push(statusChangesSubscription);
     }
 
@@ -207,9 +211,11 @@ export class EntityFormService {
   private disableReadOnlyFormControls<T extends Entity>(
     form: EntityForm<T>,
     entity: T,
+    creatingNew: boolean,
   ) {
+    const action = creatingNew ? "create" : "update";
     Object.keys(form.controls).forEach((fieldId) => {
-      if (this.ability.cannot("update", entity, fieldId)) {
+      if (this.ability.cannot(action, entity, fieldId)) {
         form.get(fieldId).disable({ onlySelf: true, emitEvent: false });
       }
     });

src/app/core/entity-details/form/form.component.ts

@@ -51,6 +51,9 @@ export class FormComponent<E extends Entity> implements FormConfig, OnInit {
     this.form = this.entityFormService.createFormGroup(
       [].concat(...this.fieldGroups.map((group) => group.fields)),
       this.entity,
+      false,
+      true,
+      this.creatingNew,
     );
 
     if (!this.creatingNew) {