client: hide "mass edit" buttons when no privilege

3 files changed, 60 insertions, 33 deletions

diff --git a/client/html/posts_header.tpl b/client/html/posts_header.tpl
index 311964c..b45106c 100644
--- a/client/html/posts_header.tpl
+++ b/client/html/posts_header.tpl
@@ -30,19 +30,21 @@
                 } else { %>Syntax help<% }
         %></a><%
         %><wbr/><%
-        %><span class="bulk-edit-btn-holder"><%
-            %><a href class='mousetrap button append open bulk-edit-btn'><%
-                if (window.innerWidth <= 500) { %>Mass<%
-                } else { %>Mass edit<% }
-                %><i class='fa fa-chevron-down icon-inline'></i><%
-            %></a><%
-            %><a href class='mousetrap button append close bulk-edit-btn'><%
-                if (window.innerWidth <= 500) { %>Mass<%
-                } else { %>Mass edit<% }
-                %><i class='fa fa-chevron-up icon-inline'></i><%
-            %></a><%
-        %></span><%
-        %><wbr/><%
+        if (ctx.canBulkEdit) {
+            %><span class="bulk-edit-btn-holder"><%
+                %><a href class='mousetrap button append open bulk-edit-btn'><%
+                    if (window.innerWidth <= 500) { %>Mass<%
+                    } else { %>Mass edit<% }
+                    %><i class='fa fa-chevron-down icon-inline'></i><%
+                %></a><%
+                %><a href class='mousetrap button append close bulk-edit-btn'><%
+                    if (window.innerWidth <= 500) { %>Mass<%
+                    } else { %>Mass edit<% }
+                    %><i class='fa fa-chevron-up icon-inline'></i><%
+                %></a><%
+            %></span><%
+            %><wbr/><%
+        }
         if (ctx.canViewMetrics) {
             %><span class="metrics-btn-holder"><%
                 %><a href class='mousetrap button append open metrics-btn'><%
diff --git a/client/js/controllers/post_list_controller.js b/client/js/controllers/post_list_controller.js
index af0fa33..416f65b 100644
--- a/client/js/controllers/post_list_controller.js
+++ b/client/js/controllers/post_list_controller.js
@@ -39,6 +39,18 @@ class PostListController {
         topNavigation.activate("posts");
         topNavigation.setTitle("Listing posts");
 
+        const canBulkEditTags = api.hasPrivilege("posts:bulk-edit:tags");
+        const canBulkEditSafety = api.hasPrivilege("posts:bulk-edit:safety");
+        const canBulkEditRelations = api.hasPrivilege(
+            "posts:bulk-edit:relations"
+        );
+        const canBulkDelete = api.hasPrivilege("posts:bulk-edit:delete");
+        const canBulkEdit =
+            canBulkEditTags ||
+            canBulkEditSafety ||
+            canBulkEditRelations ||
+            canBulkDelete;
+
         this._headerView = new PostsHeaderView({
             hostNode: this._pageController.view.pageHeaderHolderNode,
             parameters: ctx.parameters,
@@ -46,11 +58,12 @@ class PostListController {
             enableSafety: api.safetyEnabled(),
             canListSketchy: api.hasPrivilege("posts:list:sketchy"),
             canListUnsafe: api.hasPrivilege("posts:list:unsafe"),
-            canBulkEditTags: api.hasPrivilege("posts:bulk-edit:tags"),
-            canBulkEditSafety: api.hasPrivilege("posts:bulk-edit:safety"),
             canViewMetrics: api.hasPrivilege("metrics:list"),
-            canBulkEditRelations: api.hasPrivilege("posts:bulk-edit:relations"),
-            canBulkDelete: api.hasPrivilege("posts:bulk-edit:delete"),
+            canBulkEdit,
+            canBulkEditTags,
+            canBulkEditSafety,
+            canBulkEditRelations,
+            canBulkDelete,
             bulkEdit: {
                 tags: this._bulkEditTags,
             },
@@ -85,8 +98,10 @@ class PostListController {
     }
 
     get _bulkEditRelationsIds() {
-        return (this._ctx.parameters.relations || "").split(/\s+/).filter(s => s)
-            .map(id => parseInt(id));
+        return (this._ctx.parameters.relations || "")
+            .split(/\s+/)
+            .filter((s) => s)
+            .map((id) => parseInt(id));
     }
 
     _evtNavigate(e) {
@@ -95,7 +110,8 @@ class PostListController {
         );
         Object.assign(this._ctx.parameters, e.detail.parameters);
         this._bulkEditTags.map((tagName) =>
-            tags.resolveTagAndCategory(tagName)
+            tags
+                .resolveTagAndCategory(tagName)
                 .catch((error) => window.alert(error.message))
         );
         this._syncPageController();
@@ -138,14 +154,14 @@ class PostListController {
         addedPost.save().catch((error) => window.alert(error.message));
         relations.push(addedPost.id);
         this._updateRelationsForBulkEdit(relations);
-
     }
 
     _evtRemoveRelation(e) {
         let removedPost = e.detail.post;
         let relations = this._bulkEditRelationsIds;
-        removedPost.relations = removedPost.relations
-            .filter((id)=> !relations.some((relationId) => relationId == id));
+        removedPost.relations = removedPost.relations.filter(
+            (id) => !relations.some((relationId) => relationId == id)
+        );
         // Only save the updated post, the relationship will propagate to others automatically
         removedPost.save().catch((error) => window.alert(error.message));
         relations = relations.filter((id) => id != removedPost.id);
@@ -223,7 +239,9 @@ class PostListController {
                         tags: this._bulkEditTags,
                         relations: this._ctx.parameters.relations,
                     },
-                    canBulkEditRelations: api.hasPrivilege("posts:bulk-edit:relations"),
+                    canBulkEditRelations: api.hasPrivilege(
+                        "posts:bulk-edit:relations"
+                    ),
                     canBulkDelete: api.hasPrivilege("posts:bulk-edit:delete"),
                     bulkEdit: {
                         tags: this._bulkEditTags,
diff --git a/client/js/views/posts_header_view.js b/client/js/views/posts_header_view.js
index 7923752..234b596 100644
--- a/client/js/views/posts_header_view.js
+++ b/client/js/views/posts_header_view.js
@@ -256,15 +256,22 @@ class PostsHeaderView extends events.EventTarget {
             this._bulkEditors.push(this._bulkAddRelationEditor);
         }
 
-        this._bulkEditOpenButtonNode.addEventListener("click", (e) =>
-            this._evtOpenBulkEditBtnClick(e)
-        );
-        this._bulkEditCloseButtonNode.addEventListener("click", (e) =>
-            this._evtCloseBulkEditBtnClick(e)
-        );
+        if (this._bulkEditOpenButtonNode) {
+            this._bulkEditOpenButtonNode.addEventListener("click", (e) =>
+                this._evtOpenBulkEditBtnClick(e)
+            );
+        }
+        if (this._bulkEditCloseButtonNode) {
+            this._bulkEditCloseButtonNode.addEventListener("click", (e) =>
+                this._evtCloseBulkEditBtnClick(e)
+            );
+        }
 
         if (this._metricsButtonHolderNode) {
-            this._metricControl = new MetricHeaderControl(this._metricsBlockNode, ctx);
+            this._metricControl = new MetricHeaderControl(
+                this._metricsBlockNode,
+                ctx
+            );
             this._metricControl.addEventListener("submit", (e) =>
                 this._navigate()
             );
@@ -275,7 +282,7 @@ class PostsHeaderView extends events.EventTarget {
                 this._evtCloseMetricsBtnClick(e)
             );
         }
-        
+
         if (this._bulkEditDeleteNode) {
             this._bulkDeleteEditor = new BulkDeleteEditor(
                 this._bulkEditDeleteNode
@@ -515,7 +522,7 @@ class PostsHeaderView extends events.EventTarget {
         let parameters = {
             query: this._queryInputNode.value,
             cachenumber: this._ctx.parameters.cachenumber,
-            metrics: this._ctx.parameters.metrics
+            metrics: this._ctx.parameters.metrics,
         };
 
         // convert falsy values to an empty string "" so that we can correctly compare with the current query