From 90d452ab6cb0567d713cf71ebdd6590232cd8616 Mon Sep 17 00:00:00 2001
From: Ted Johansson <ted@discourse.org>
Date: Fri, 20 Jan 2023 11:16:04 +0800
Subject: [PATCH] FIX: Don't display staff-only options to non-staff in group
 member bulk menu (#19907)

In the group member bulk edit menu we are displaying staff-only options
to non-staff. The requests are blocked by the back-end, so there is no
harm other than to the user experience.

Notably the individual user edit menu is correctly filtering out
unavailable options. This change brings the bulk edit menu in line with
that.
---
 .../components/bulk-group-member-dropdown.js  | 32 +++++++------
 .../tests/acceptance/group-index-test.js      | 48 +++++++++++++++++--
 2 files changed, 62 insertions(+), 18 deletions(-)

diff --git a/app/assets/javascripts/discourse/app/components/bulk-group-member-dropdown.js b/app/assets/javascripts/discourse/app/components/bulk-group-member-dropdown.js
index baeddb07466..76fe26e6d5e 100644
--- a/app/assets/javascripts/discourse/app/components/bulk-group-member-dropdown.js
+++ b/app/assets/javascripts/discourse/app/components/bulk-group-member-dropdown.js
@@ -39,22 +39,24 @@ export default DropdownSelectBoxComponent.extend({
       });
     }
 
-    if (this.bulkSelection.some((m) => !m.primary)) {
-      items.push({
-        id: "setPrimary",
-        name: I18n.t("groups.members.make_all_primary"),
-        description: I18n.t("groups.members.make_all_primary_description"),
-        icon: "id-card",
-      });
-    }
+    if (this.currentUser.staff) {
+      if (this.bulkSelection.some((m) => !m.primary)) {
+        items.push({
+          id: "setPrimary",
+          name: I18n.t("groups.members.make_all_primary"),
+          description: I18n.t("groups.members.make_all_primary_description"),
+          icon: "id-card",
+        });
+      }
 
-    if (this.bulkSelection.some((m) => m.primary)) {
-      items.push({
-        id: "unsetPrimary",
-        name: I18n.t("groups.members.remove_all_primary"),
-        description: I18n.t("groups.members.remove_all_primary_description"),
-        icon: "id-card",
-      });
+      if (this.bulkSelection.some((m) => m.primary)) {
+        items.push({
+          id: "unsetPrimary",
+          name: I18n.t("groups.members.remove_all_primary"),
+          description: I18n.t("groups.members.remove_all_primary_description"),
+          icon: "id-card",
+        });
+      }
     }
 
     return items;
diff --git a/app/assets/javascripts/discourse/tests/acceptance/group-index-test.js b/app/assets/javascripts/discourse/tests/acceptance/group-index-test.js
index 226775a6805..2707adf91d9 100644
--- a/app/assets/javascripts/discourse/tests/acceptance/group-index-test.js
+++ b/app/assets/javascripts/discourse/tests/acceptance/group-index-test.js
@@ -72,10 +72,9 @@ acceptance("Group Members", function (needs) {
     );
   });
 
-  test("Shows bulk actions", async function (assert) {
+  test("Shows bulk actions as an admin user", async function (assert) {
     await visit("/g/discourse");
 
-    assert.ok(exists("button.bulk-select"));
     await click("button.bulk-select");
 
     await click(queryAll("input.bulk-select")[0]);
@@ -83,7 +82,50 @@ acceptance("Group Members", function (needs) {
 
     const memberDropdown = selectKit(".bulk-group-member-dropdown");
     await memberDropdown.expand();
-    await memberDropdown.selectRowByValue("makeOwners");
+
+    assert.ok(
+      exists('[data-value="removeMembers"]'),
+      "it includes remove member option"
+    );
+
+    assert.ok(
+      exists('[data-value="makeOwners"]'),
+      "it includes make owners option"
+    );
+
+    assert.ok(
+      exists('[data-value="setPrimary"]'),
+      "it includes set primary option"
+    );
+  });
+
+  test("Shows bulk actions as a group owner", async function (assert) {
+    updateCurrentUser({ moderator: false, admin: false });
+
+    await visit("/g/discourse");
+
+    await click("button.bulk-select");
+
+    await click(queryAll("input.bulk-select")[0]);
+    await click(queryAll("input.bulk-select")[1]);
+
+    const memberDropdown = selectKit(".bulk-group-member-dropdown");
+    await memberDropdown.expand();
+
+    assert.ok(
+      exists('[data-value="removeMembers"]'),
+      "it includes remove member option"
+    );
+
+    assert.ok(
+      exists('[data-value="makeOwners"]'),
+      "it includes make owners option"
+    );
+
+    assert.notOk(
+      exists('[data-value="setPrimary"]'),
+      "it does not include set primary (staff only) option"
+    );
   });
 
   test("Bulk actions - Menu, Select all and Clear all buttons", async function (assert) {