From c626558d36c3e50de7abc332fd7bf55c7829cbd6 Mon Sep 17 00:00:00 2001
From: Arpit Jalan <arpit@techapj.com>
Date: Sat, 9 Jul 2016 00:50:04 +0530
Subject: [PATCH] UX: group pages should not show Messages tab to unauthorised
 users (#4318)

---
 .../discourse/controllers/group.js.es6         | 18 +++++++++++-------
 .../javascripts/discourse/templates/group.hbs  |  2 +-
 app/serializers/basic_group_serializer.rb      |  9 +++++++++
 .../admin/groups_controller_spec.rb            |  1 +
 4 files changed, 22 insertions(+), 8 deletions(-)

diff --git a/app/assets/javascripts/discourse/controllers/group.js.es6 b/app/assets/javascripts/discourse/controllers/group.js.es6
index 819047536ab..ac16e4342e0 100644
--- a/app/assets/javascripts/discourse/controllers/group.js.es6
+++ b/app/assets/javascripts/discourse/controllers/group.js.es6
@@ -16,6 +16,13 @@ var Tab = Em.Object.extend({
 export default Ember.Controller.extend({
   counts: null,
   showing: 'members',
+  tabs: [
+    Tab.create({ name: 'members', active: true, 'location': 'group.index' }),
+    Tab.create({ name: 'posts' }),
+    Tab.create({ name: 'topics' }),
+    Tab.create({ name: 'mentions' }),
+    Tab.create({ name: 'messages', requiresMembership: true })
+  ],
 
   @observes('counts')
   countsChanged() {
@@ -34,11 +41,8 @@ export default Ember.Controller.extend({
     });
   },
 
-  tabs: [
-    Tab.create({ name: 'members', active: true, 'location': 'group.index' }),
-    Tab.create({ name: 'posts' }),
-    Tab.create({ name: 'topics' }),
-    Tab.create({ name: 'mentions' }),
-    Tab.create({ name: 'messages' }),
-  ]
+  @computed('model.is_member')
+  getTabs(isMember) {
+    return this.get('tabs').filter(t => isMember || !t.get('requiresMembership'));
+  }
 });
diff --git a/app/assets/javascripts/discourse/templates/group.hbs b/app/assets/javascripts/discourse/templates/group.hbs
index 6ad3e0ca3be..416b356f405 100644
--- a/app/assets/javascripts/discourse/templates/group.hbs
+++ b/app/assets/javascripts/discourse/templates/group.hbs
@@ -2,7 +2,7 @@
   <div class="wrapper">
   <section class='user-navigation'>
     <ul class='action-list nav-stacked'>
-      {{#each tabs as |tab|}}
+      {{#each getTabs as |tab|}}
         <li class="{{if tab.active 'active'}}">
           {{#link-to tab.location model title=tab.message}}
             {{tab.message}}
diff --git a/app/serializers/basic_group_serializer.rb b/app/serializers/basic_group_serializer.rb
index 725de396e5a..6f52b98d3d4 100644
--- a/app/serializers/basic_group_serializer.rb
+++ b/app/serializers/basic_group_serializer.rb
@@ -13,6 +13,7 @@ class BasicGroupSerializer < ApplicationSerializer
              :incoming_email,
              :notification_level,
              :has_messages,
+             :is_member,
              :mentionable
 
   def include_incoming_email?
@@ -32,4 +33,12 @@ class BasicGroupSerializer < ApplicationSerializer
     object.mentionable?(scope.user, object.id)
   end
 
+  def is_member
+    scope.is_admin? || GroupUser.where(group_id: object.id, user_id: scope.user.id).present?
+  end
+
+  def include_is_member?
+    scope.authenticated?
+  end
+
 end
diff --git a/spec/controllers/admin/groups_controller_spec.rb b/spec/controllers/admin/groups_controller_spec.rb
index 96fb3d229ab..1cb18f64e57 100644
--- a/spec/controllers/admin/groups_controller_spec.rb
+++ b/spec/controllers/admin/groups_controller_spec.rb
@@ -34,6 +34,7 @@ describe Admin::GroupsController do
         "incoming_email"=>nil,
         "notification_level"=>2,
         "has_messages"=>false,
+        "is_member"=>true,
         "mentionable"=>false
       }])
     end