PT-14710: check permission to load vendors (#715)

VirtoCommerce · Dec 20, 2023 · 76b200b · 76b200b
1 parent c30c47e
commit 76b200b
Show file tree

Hide file tree

Showing 5 changed files with 9 additions and 1 deletion.
diff --git a/src/VirtoCommerce.CatalogModule.Web/Localizations/de.VirtoCommerce.Catalog.json b/src/VirtoCommerce.CatalogModule.Web/Localizations/de.VirtoCommerce.Catalog.json
@@ -240,6 +240,7 @@
  "min-quantity": "Min. Menge",
  "max-quantity": "Max. Menge",
  "vendor": "Anbieter",
+ "vendor-denied": "Zugriff verweigert",
  "tax-type": "Steuertyp",
  "weight-unit": "Gewichtseinheit",
  "weight": "Gewicht",

diff --git a/src/VirtoCommerce.CatalogModule.Web/Localizations/en.VirtoCommerce.Catalog.json b/src/VirtoCommerce.CatalogModule.Web/Localizations/en.VirtoCommerce.Catalog.json
@@ -327,6 +327,7 @@
  "min-quantity": "Min. quantity",
  "max-quantity": "Max. quantity",
  "vendor": "Vendor",
+ "vendor-denied": "Access denied",
  "tax-type": "Tax type",
  "package-type": "Package type",
  "weight-unit": "Mass units",

diff --git a/src/VirtoCommerce.CatalogModule.Web/Localizations/ru.VirtoCommerce.Catalog.json b/src/VirtoCommerce.CatalogModule.Web/Localizations/ru.VirtoCommerce.Catalog.json
@@ -320,6 +320,7 @@
  "min-quantity": "Минимальное количество",
  "max-quantity": "Максимальное количество",
  "vendor": "Продавец",
+ "vendor-denied": "Доступ запрещён",
  "tax-type": "Тип налога",
  "package-type": "Тип упаковки",
  "weight-unit": "Единица веса",

diff --git a/src/VirtoCommerce.CatalogModule.Web/Scripts/blades/item-detail.js b/src/VirtoCommerce.CatalogModule.Web/Scripts/blades/item-detail.js
@@ -8,6 +8,8 @@ angular.module('virtoCommerce.catalogModule')
  blade.metaFields1 = metaFormsService.getMetaFields("productDetail1");
  blade.metaFields2 = metaFormsService.getMetaFields("productDetail2");
 
+ blade.hasVendorsPermission = bladeNavigationService.checkPermission('customer:read');
+
  blade.refresh = function (parentRefresh) {
  blade.isLoading = true;
  //2015 = Full ~& Variations do not load product variations
@@ -180,7 +182,9 @@ angular.module('virtoCommerce.catalogModule')
  };
 
  blade.fetchVendors = function (criteria) {
- return members.search(criteria);
+ return blade.hasVendorsPermission
+ ? members.search(criteria)
+ : criteria.objectIds.map(x => ({ id: x, name: $translate.instant('catalog.blades.item-detail.labels.vendor-denied') }));
  }
 
  blade.openVendorsManagement = function () {

diff --git a/src/VirtoCommerce.CatalogModule.Web/Scripts/blades/item-detail.tpl.html b/src/VirtoCommerce.CatalogModule.Web/Scripts/blades/item-detail.tpl.html
@@ -86,6 +86,7 @@
  <div class="form-group">
  <label class="form-label">{{ 'catalog.blades.item-detail.labels.vendor' | translate }} <a href="" ng-click="blade.openVendorsManagement()" class="form-edit" va-permission="customer:read"><i class="form-ico fa fa-pencil"></i></a></label>
  <ui-scroll-drop-down ng-model="blade.item.vendor"
+ disabled="!blade.hasVendorsPermission"
  data="blade.fetchVendors(criteria)"
  placeholder="'catalog.blades.item-detail.placeholders.vendor'">
  </ui-scroll-drop-down>