From a95b2f9140c422423d8963007fdfcd49ba74f392 Mon Sep 17 00:00:00 2001
From: Ted Johansson <ted@discourse.org>
Date: Fri, 20 Jan 2023 11:16:04 +0800
Subject: [PATCH] FIX: Don't display staff-only options to non-staff in group
 member bulk menu (#19907)

In the group member bulk edit menu we are displaying staff-only options
to non-staff. The requests are blocked by the back-end, so there is no
harm other than to the user experience.

Notably the individual user edit menu is correctly filtering out
unavailable options. This change brings the bulk edit menu in line with
that.
---
 .../components/bulk-group-member-dropdown.js  | 32 +++++++------
 .../tests/acceptance/group-index-test.js      | 48 +++++++++++++++++--
 2 files changed, 62 insertions(+), 18 deletions(-)

diff --git a/app/assets/javascripts/discourse/app/components/bulk-group-member-dropdown.js b/app/assets/javascripts/discourse/app/components/bulk-group-member-dropdown.js
index baeddb0746..76fe26e6d5 100644
--- a/app/assets/javascripts/discourse/app/components/bulk-group-member-dropdown.js
+++ b/app/assets/javascripts/discourse/app/components/bulk-group-member-dropdown.js
@@ -39,22 +39,24 @@ export default DropdownSelectBoxComponent.extend({
       });
     }
 
-    if (this.bulkSelection.some((m) => !m.primary)) {
-      items.push({
-        id: "setPrimary",
-        name: I18n.t("groups.members.make_all_primary"),
-        description: I18n.t("groups.members.make_all_primary_description"),
-        icon: "id-card",
-      });
-    }
+    if (this.currentUser.staff) {
+      if (this.bulkSelection.some((m) => !m.primary)) {
+        items.push({
+          id: "setPrimary",
+          name: I18n.t("groups.members.make_all_primary"),
+          description: I18n.t("groups.members.make_all_primary_description"),
+          icon: "id-card",
+        });
+      }
 
-    if (this.bulkSelection.some((m) => m.primary)) {
-      items.push({
-        id: "unsetPrimary",
-        name: I18n.t("groups.members.remove_all_primary"),
-        description: I18n.t("groups.members.remove_all_primary_description"),
-        icon: "id-card",
-      });
+      if (this.bulkSelection.some((m) => m.primary)) {
+        items.push({
+          id: "unsetPrimary",
+          name: I18n.t("groups.members.remove_all_primary"),
+          description: I18n.t("groups.members.remove_all_primary_description"),
+          icon: "id-card",
+        });
+      }
     }
 
     return items;
diff --git a/app/assets/javascripts/discourse/tests/acceptance/group-index-test.js b/app/assets/javascripts/discourse/tests/acceptance/group-index-test.js
index 020a5a4463..f5e0081a87 100644
--- a/app/assets/javascripts/discourse/tests/acceptance/group-index-test.js
+++ b/app/assets/javascripts/discourse/tests/acceptance/group-index-test.js
@@ -72,10 +72,9 @@ acceptance("Group Members", function (needs) {
     );
   });
 
-  test("Shows bulk actions", async function (assert) {
+  test("Shows bulk actions as an admin user", async function (assert) {
     await visit("/g/discourse");
 
-    assert.ok(exists("button.bulk-select"));
     await click("button.bulk-select");
 
     await click(queryAll("input.bulk-select")[0]);
@@ -83,7 +82,50 @@ acceptance("Group Members", function (needs) {
 
     const memberDropdown = selectKit(".bulk-group-member-dropdown");
     await memberDropdown.expand();
-    await memberDropdown.selectRowByValue("makeOwners");
+
+    assert.ok(
+      exists('[data-value="removeMembers"]'),
+      "it includes remove member option"
+    );
+
+    assert.ok(
+      exists('[data-value="makeOwners"]'),
+      "it includes make owners option"
+    );
+
+    assert.ok(
+      exists('[data-value="setPrimary"]'),
+      "it includes set primary option"
+    );
+  });
+
+  test("Shows bulk actions as a group owner", async function (assert) {
+    updateCurrentUser({ moderator: false, admin: false });
+
+    await visit("/g/discourse");
+
+    await click("button.bulk-select");
+
+    await click(queryAll("input.bulk-select")[0]);
+    await click(queryAll("input.bulk-select")[1]);
+
+    const memberDropdown = selectKit(".bulk-group-member-dropdown");
+    await memberDropdown.expand();
+
+    assert.ok(
+      exists('[data-value="removeMembers"]'),
+      "it includes remove member option"
+    );
+
+    assert.ok(
+      exists('[data-value="makeOwners"]'),
+      "it includes make owners option"
+    );
+
+    assert.notOk(
+      exists('[data-value="setPrimary"]'),
+      "it does not include set primary (staff only) option"
+    );
   });
 
   test("Bulk actions - Menu, Select all and Clear all buttons", async function (assert) {