fix upgrade-step, remote unused user action and add actions to @feedb…

…acks endpoint

CHANGES.rst

@@ -14,6 +14,10 @@ Changelog
   [cekk]
 - Install souper.plone to have its control-panel in backend.
   [cekk]
+- Remove unused user action.
+  [cekk]
+- Add `actions` infos in @feedback endpoint, to let the frontend know what the user can do.
+  [cekk]
 
 1.0.0 (2023-02-16)
 ------------------

src/collective/feedback/configure.zcml

@@ -9,10 +9,10 @@
   <i18n:registerTranslations directory="locales" />
 
   <include file="permissions.zcml" />
+  <include file="upgrades.zcml" />
 
   <include package=".storage" />
   <include package=".restapi" />
-  <include package=".upgrades" />
 
 
   <genericsetup:registerProfile
@@ -33,6 +33,14 @@
       post_handler=".setuphandlers.uninstall"
       />
 
+  <genericsetup:registerProfile
+      name="to_1100"
+      title="collective.feedback (to_1100)"
+      description=""
+      provides="Products.GenericSetup.interfaces.EXTENSION"
+      directory="profiles/to_1100"
+      />
+
   <utility
       factory=".setuphandlers.HiddenProfiles"
       name="collective.feedback-hiddenprofiles"

src/collective/feedback/permissions.zcml

@@ -6,8 +6,8 @@
 
   <configure zcml:condition="installed AccessControl.security">
     <permission
-        id="collective.feedback.ManageFeedbacks"
-        title="collective.feedback: Manage Feedbacks"
+        id="collective.feedback.DeleteFeedbacks"
+        title="collective.feedback: Delete Feedbacks"
         />
     <permission
         id="collective.feedback.AccessFeedbacks"
@@ -17,6 +17,11 @@
         id="collective.feedback.FeedbacksOverview"
         title="collective.feedback: Feedbacks Overview"
         />
+    <permission
+        id="collective.feedback.ShowDeletedFeedbacks"
+        title="collective.feedback: Show Deleted Feedbacks"
+        />
+
   </configure>
 
 </configure>

src/collective/feedback/profiles/default/metadata.xml

@@ -1,6 +1,6 @@
 <?xml version="1.0" encoding="utf-8"?>
 <metadata>
-  <version>1000</version>
+  <version>1100</version>
   <dependencies>
     <dependency>profile-plone.restapi:default</dependency>
     <dependency>profile-souper.plone:default</dependency>

src/collective/feedback/profiles/default/rolemap.xml

@@ -3,7 +3,7 @@
   <permissions>
 
     <permission acquire="True"
-                name="collective.feedback: Manage Feedbacks"
+                name="collective.feedback: Delete Feedbacks"
     >
       <role name="Manager" />
       <role name="Site Administrator" />
@@ -20,5 +20,11 @@
     <permission acquire="True" name="collective.feedback: Feedbacks Overview">
       <role name="Authenticated" />
     </permission>
+
+    <permission acquire="True" name="collective.feedback: Show Deleted Feedbacks">
+      <role name="Manager" />
+      <role name="Site Administrator" />
+    </permission>
+
   </permissions>
 </rolemap>

src/collective/feedback/profiles/default/to_1100/rolemap.xml

@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="utf-8"?>
+<rolemap>
+  <permissions>
+    <permission remove="True" name="collective.feedback: Manage Feedbacks" />
+  </permissions>
+</rolemap>

src/collective/feedback/restapi/services/configure.zcml

@@ -33,7 +33,7 @@
       method="DELETE"
       factory=".delete.FeedbackDelete"
       for="plone.app.layout.navigation.interfaces.INavigationRoot"
-      permission="collective.feedback.ManageFeedbacks"
+      permission="collective.feedback.DeleteFeedbacks"
       layer="collective.feedback.interfaces.ICollectiveFeedbackLayer"
       name="@feedback-delete"
       />

src/collective/feedback/restapi/services/get.py

@@ -44,8 +44,12 @@ def reply(self):
         if links:
             data["batching"] = links
 
+        data["actions"] = {"can_delete_feedbacks": self.can_delete_feedbacks()}
         return data
 
+    def can_delete_feedbacks(self):
+        return api.user.has_permission("collective.feedback: Delete Feedbacks")
+
     def fix_fields(self, data):
         """
         Make data json compatible

src/collective/feedback/setuphandlers.py

@@ -9,6 +9,7 @@ def getNonInstallableProfiles(self):
         """Hide uninstall profile from site-creation and quickinstaller."""
         return [
             "collective.feedback:uninstall",
+            "collective.feedback:to_1100",
         ]
 
     def getNonInstallableProducts(self):

src/collective/feedback/tests/test_feedbacks_get.py

@@ -209,3 +209,27 @@ def test_only_admins_can_see_deleted_contents(self):
         res = response.json()
 
         self.assertEqual(res["items_total"], 1)
+
+    def test_actions_list_returned(self):
+        response = self.api_session.get(self.url)
+        res = response.json()
+        self.assertIn("actions", res)
+
+    def test_users_with_permission_have_can_delete_feedbacks_action(self):
+
+        response = self.api_session.get(self.url)
+        res = response.json()
+        self.assertIn("can_delete_feedbacks", res["actions"])
+        self.assertTrue(res["actions"]["can_delete_feedbacks"])
+
+    def test_users_without_permission_dont_have_can_delete_feedbacks_action(self):
+
+        api_session = RelativeSession(self.portal_url)
+        api_session.headers.update({"Accept": "application/json"})
+        api_session.auth = ("global", "secret!!")
+
+        response = api_session.get(self.url)
+        res = response.json()
+
+        self.assertIn("can_delete_feedbacks", res["actions"])
+        self.assertFalse(res["actions"]["can_delete_feedbacks"])

src/collective/feedback/upgrades.py

@@ -36,3 +36,8 @@ def update_controlpanel(context):
 
 def to_1100(context):
     installOrReinstallProduct(api.portal.get(), "souper.plone")
+    context.runAllImportStepsFromProfile("profile-collective.feedback:to_1100")
+
+    # remove broken action
+    if "feedback-dashboard" in context.portal_actions.user:
+        del context.portal_actions.user["feedback-dashboard"]