Merge pull request #3163 from seand7565/stock_display_fix

Disable adjust stock field when user does not have the correct permission
solidusio · May 9, 2019 · b692435 · b692435
2 parents a616ed9 + 06b4991
commit b692435
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 1 deletion.
diff --git a/backend/app/assets/javascripts/spree/backend/stock_management.js b/backend/app/assets/javascripts/spree/backend/stock_management.js
@@ -3,6 +3,7 @@ Spree.ready(function() {
     var $el = $(this);
     var model = new Spree.Models.StockItem($el.data('stock-item'));
     var trackInventory = $el.data('track-inventory');
+    var canEdit = $el.data('can-edit')
     new Spree.Views.Stock.EditStockItemRow({
       el: $el,
       stockLocationName: $el.data('stock-location-name'),
@@ -16,6 +17,14 @@ Spree.ready(function() {
         title: '"Track inventory" option disabled for this variant'
       });
     }
+
+    if (canEdit == false) {
+      $('.js-edit-stock-item input').attr({
+        disabled: true,
+        class: 'with-tip',
+        title: 'You do not have permission to manage stock'
+      });
+    }
   });
 
   $('.js-add-stock-item').each(function() {

diff --git a/backend/app/views/spree/admin/stock_items/_stock_management.html.erb b/backend/app/views/spree/admin/stock_items/_stock_management.html.erb
@@ -72,7 +72,7 @@
             </colgroup>
             <% variant.stock_items.each do |item| %>
               <% if @stock_item_stock_locations.include?(item.stock_location) %>
-                <tr class="js-edit-stock-item stock-item-edit-row" data-variant-id="<%= variant.id %>" data-stock-item="<%= item.to_json %>" data-stock-location-name="<%= item.stock_location.name %>" data-track-inventory="<%= variant.should_track_inventory? %>">
+                <tr class="js-edit-stock-item stock-item-edit-row" data-variant-id="<%= variant.id %>" data-stock-item="<%= item.to_json %>" data-stock-location-name="<%= item.stock_location.name %>" data-track-inventory="<%= variant.should_track_inventory? %>" data-can-edit="<%= can?(:admin, Spree::StockItem) %>">
                   <%# This is rendered in JS %>
                 </tr>
               <% end %>