From 88377b31804fd4bd44e08e8629051798304027bc Mon Sep 17 00:00:00 2001
From: Riley Davis <riley.davis@gmail.com>
Date: Wed, 17 May 2017 15:37:13 -0600
Subject: [PATCH] do not show Config tab for non-admins

---
 .../coral-admin/src/components/ui/Header.js   | 27 +++++++++++++------
 .../coral-admin/src/components/ui/Layout.js   |  7 ++++-
 .../src/containers/Configure/Configure.js     |  7 +++++
 client/coral-framework/utils/roles.js         |  2 +-
 4 files changed, 33 insertions(+), 10 deletions(-)

diff --git a/client/coral-admin/src/components/ui/Header.js b/client/coral-admin/src/components/ui/Header.js
index 6418efb10..32df0c011 100644
--- a/client/coral-admin/src/components/ui/Header.js
+++ b/client/coral-admin/src/components/ui/Header.js
@@ -5,8 +5,14 @@ import styles from './Header.css';
 import I18n from 'coral-framework/modules/i18n/i18n';
 import translations from '../../translations.json';
 import {Logo} from './Logo';
+import {can} from 'coral-framework/utils/roles';
 
-const CoralHeader = ({handleLogout, showShortcuts = () => {}, restricted = false}) => (
+const CoralHeader = ({
+  handleLogout,
+  showShortcuts = () => {},
+  restricted = false,
+  auth
+}) => (
   <Header className={styles.header}>
     <Logo className={styles.logo} />
     {
@@ -41,13 +47,17 @@ const CoralHeader = ({handleLogout, showShortcuts = () => {}, restricted = false
             activeClassName={styles.active}>
             {lang.t('configure.community')}
           </Link>
-          <Link
-            id='configureNav'
-            className={styles.navLink}
-            to="/admin/configure"
-            activeClassName={styles.active}>
-            {lang.t('configure.configure')}
-          </Link>
+          {
+            auth.user && can(auth.user, 'UPDATE_CONFIG') && (
+              <Link
+                id='configureNav'
+                className={styles.navLink}
+                to="/admin/configure"
+                activeClassName={styles.active}>
+                {lang.t('configure.configure')}
+              </Link>
+            )
+          }
         </Navigation>
         <div className={styles.rightPanel}>
           <ul>
@@ -73,6 +83,7 @@ const CoralHeader = ({handleLogout, showShortcuts = () => {}, restricted = false
 );
 
 CoralHeader.propTypes = {
+  auth: PropTypes.object.isRequired,
   showShortcuts: PropTypes.func,
   handleLogout: PropTypes.func.isRequired,
   restricted: PropTypes.bool // hide elemnts from a user that's logged out
diff --git a/client/coral-admin/src/components/ui/Layout.js b/client/coral-admin/src/components/ui/Layout.js
index 6bf9661b7..cb783ce5e 100644
--- a/client/coral-admin/src/components/ui/Layout.js
+++ b/client/coral-admin/src/components/ui/Layout.js
@@ -4,7 +4,12 @@ import Header from './Header';
 import Drawer from './Drawer';
 import styles from './Layout.css';
 
-const Layout = ({children, handleLogout = () => {}, toggleShortcutModal, restricted = false, ...props}) => (
+const Layout = ({
+  children,
+  handleLogout = () => {},
+  toggleShortcutModal,
+  restricted = false,
+  ...props}) => (
   <LayoutMDL fixedDrawer>
     <Header
       handleLogout={handleLogout}
diff --git a/client/coral-admin/src/containers/Configure/Configure.js b/client/coral-admin/src/containers/Configure/Configure.js
index e041edfe3..44c38cd50 100644
--- a/client/coral-admin/src/containers/Configure/Configure.js
+++ b/client/coral-admin/src/containers/Configure/Configure.js
@@ -15,6 +15,7 @@ import translations from 'coral-admin/src/translations.json';
 import StreamSettings from './StreamSettings';
 import ModerationSettings from './ModerationSettings';
 import TechSettings from './TechSettings';
+import {can} from 'coral-framework/utils/roles';
 
 class Configure extends Component {
   constructor (props) {
@@ -118,6 +119,11 @@ class Configure extends Component {
   render () {
     const {activeSection} = this.state;
     const section = this.getSection(activeSection);
+    const {auth: user} = this.props;
+
+    if (!can(user, 'UPDATE_CONFIG')) {
+      return <p>You must be an administrator to access config settings. Please find the nearest Admin and ask them to level you up!</p>;
+    }
 
     const showSave = Object.keys(this.state.errors).reduce(
       (bool, error) => this.state.errors[error] ? false : bool, this.state.changed);
@@ -172,6 +178,7 @@ class Configure extends Component {
 }
 
 const mapStateToProps = (state) => ({
+  auth: state.auth.toJS(),
   settings: state.settings.toJS()
 });
 export default connect(mapStateToProps)(Configure);
diff --git a/client/coral-framework/utils/roles.js b/client/coral-framework/utils/roles.js
index f5a285e17..e93744506 100644
--- a/client/coral-framework/utils/roles.js
+++ b/client/coral-framework/utils/roles.js
@@ -5,7 +5,7 @@ const basicRoles = {
 };
 
 const queryRoles = {
-  UPDATE_CONFIG: ['ADMIN', 'MODERATOR'],
+  UPDATE_CONFIG: ['ADMIN'],
   ACCESS_ADMIN: ['ADMIN', 'MODERATOR'],
   VIEW_USER_EMAILS: ['ADMIN']
 };