additional safety measures, disabled label, added deadline to message

src/app/addoption-dialog/addoption-dialog.page.html

@@ -41,7 +41,8 @@ <h1 [innerHtml]="'addoption.header'|translate"></h1>
               : 'draftpoll.target-name-label') | translate">
           </span>
         </ion-label>
-        <ion-input 
+        <ion-input  
+          [disabled]="!p.can_add_option()"
           formControlName="option_name" 
           autofocus="true" #focus_element
           [placeholder]="(p.type == 'winner' 
@@ -69,6 +70,7 @@ <h1 [innerHtml]="'addoption.header'|translate"></h1>
           </span>
         </ion-label>
         <ion-textarea 
+          [disabled]="!p.can_add_option()"
           formControlName="option_desc" [maxlength]="E.max_len.desc"
           [placeholder]="'draftpoll.option-desc-placeholder'|translate:{name:formGroup.get('option_name').value}"
           rows="1" auto-grow type="text" 
@@ -93,6 +95,7 @@ <h1 [innerHtml]="'addoption.header'|translate"></h1>
           </span>
         </ion-label>
         <ion-input 
+          [disabled]="!p.can_add_option()"
           formControlName="option_url" 
           [placeholder]="'draftpoll.option-url-placeholder'|translate:{name:formGroup.get('option_name').value}"
           type="text" inputmode="url" [maxlength]="E.max_len.url"

src/app/addoption-dialog/addoption-dialog.page.ts

@@ -97,33 +97,35 @@ export class AddoptionDialogPage implements OnInit {
     }
 
   OK_button_clicked() {
-    /** add the option */
-    const name = this.formGroup.get('option_name').value,
-          desc = this.formGroup.get('option_desc').value,
-          url = this.formGroup.get('option_url').value,
-          o = new Option(this.G, this.p, null, name, desc, url);
-    LocalNotifications.schedule({
-      notifications: [{
-        title: this.translate.instant("addoption.notification-added-title"),
-        body: name,
-        id: 0
-      }]
-    })
-    .then(res => {
-    }).catch(err => {
-    });
-    if (this.parent.delegation_status == 'agreed') {
-      this.G.Del.update_my_delegation(this.p.pid, o.oid, true);
+    if (!this.isAddButtonDisabled()) {
+      /** add the option */
+      const name = this.formGroup.get('option_name').value,
+            desc = this.formGroup.get('option_desc').value,
+            url = this.formGroup.get('option_url').value,
+            o = new Option(this.G, this.p, null, name, desc, url);
+      LocalNotifications.schedule({
+        notifications: [{
+          title: this.translate.instant("addoption.notification-added-title"),
+          body: name,
+          id: 0
+        }]
+      })
+      .then(res => {
+      }).catch(err => {
+      });
+      if (this.parent.delegation_status == 'agreed') {
+        this.G.Del.update_my_delegation(this.p.pid, o.oid, true);
+      }
+      this.p.set_my_own_rating(o.oid, this.G.S.default_wap);
+      this.parent.oidsorted.push(o.oid);
+      this.parent.sortingcounter++;
+      this.ref.detectChanges();
+      // need to wait a little for the view to refresh:
+      setTimeout(() => {
+        this.p.tally_all();
+        this.popover.dismiss();
+      }, 200);
     }
-    this.p.set_my_own_rating(o.oid, this.G.S.default_wap);
-    this.parent.oidsorted.push(o.oid);
-    this.parent.sortingcounter++;
-    this.ref.detectChanges();
-    // need to wait a little for the view to refresh:
-    setTimeout(() => {
-      this.p.tally_all();
-      this.popover.dismiss();
-    }, 200);
   }
 
   ClosePopover()

src/app/openpoll/vodle/package.json

@@ -0,0 +1,4 @@
+{
+    "name": "vodle",
+    "description": "vodle CouchDB logics: contains a validation function to restrict permissions in _user database"
+}

src/app/openpoll/vodle/validate_doc_update.js

@@ -0,0 +1,43 @@
+function(newDoc, savedDoc, userCtx) {
+    // restrict permissions so that only "vodle" can create users,
+    // a user can only update their own user doc,
+    // but "vodle" cannot even do that (so that no-one can change this shared user's password!):
+    if (!(userCtx.name == "admin")) {
+        // restrict what others than "admin" can do:
+        if (!savedDoc) {
+            // Attempt to create new doc
+            // Make sure only "vodle" can do this:
+            if (!(userCtx.name == "vodle")) {
+                throw ({forbidden: 'Only users "admin" and "vodle" may create new users.'});
+            }
+            // Make sure new doc is a user doc whose name begins with "vodle.":
+            if (!newDoc._id.startsWith("org.couchdb.user:vodle.")) {
+                throw ({forbidden: 'New usernames must start with "vodle.".'});
+            }
+        } else if (!newDoc) {
+            // Attempt to delete existing doc
+            // Make sure only the user themself can do this to her user doc:
+            if (!(savedDoc._id == "org.couchdb.user:"+userCtx.name)) {
+                throw ({forbidden: 'Users may only delete their own user document.'});
+            }
+            // Make sure special user "vodle" can NOT delete their own document:
+            if (userCtx.name == "vodle") {
+                throw ({forbidden: 'User "vodle" may not delete any user document.'});
+            }
+        } else {
+            // Attempt to delete or update existing doc
+            // Make sure only the user themself can do this to her user doc:
+            if (!(newDoc._id == "org.couchdb.user:"+userCtx.name)) {
+                throw ({forbidden: 'Users may only delete or update their own user document.'});
+            }
+            // Make sure special user "vodle" can NOT update their own user document:
+            if (userCtx.name == "vodle") {
+                throw ({forbidden: 'User "vodle" may not delete or update any user document.'});
+            }
+            // Make sure poll users "vodle.poll.XXX" can NOT update their own user documents either:
+            if (userCtx.name.beginsWith("vodle.poll.") && !userCtx.name.includes(".voter.")) {
+                throw ({forbidden: 'Poll users "vodle.poll.XXX" may not delete or update any user document.'});
+            }
+        }
+    }
+}

src/app/poll.service.ts

@@ -1922,8 +1922,11 @@ export class Poll {
        }
   }
 
-
-
+  add_option_deadline(): Date {
+    const t0 = this.start_date.getTime(),
+          t2 = this.due.getTime();
+    return new Date(t2 - (t2 - t0) * environment.no_more_options_time_fraction);  
+  } 
 }
 
 

src/app/poll/poll.page.html

@@ -941,8 +941,8 @@ <h3><b>
             [disabled]="!p.can_add_option()">
           </ion-button>
         </ion-item>
-        <ion-item lines="none" style="padding-bottom: 10px!important;">
-          <small [innerHtml]="'poll.add-option-info' | translate"></small>
+        <ion-item lines="none" style="padding-bottom: 10px!important;" [disabled]="!p.can_add_option()">
+          <small [innerHtml]="'poll.add-option-info' | translate:{deadline:G.D.format_date(p.add_option_deadline())}"></small>
         </ion-item>
       </ng-container>
 

src/assets/i18n/de.json

@@ -594,7 +594,7 @@
         "average-rating": "durchschn. Wap {{average}}",
         "explain": "Erklären",
         "add-option": "Option hinzufügen",
-        "add-option-info": "Wenn Du denkst, eine wichtige Option fehlt noch und ist nicht von den anderen Optionen mit abgedeckt, kannst Du sie hinzufügen. Einmal hinzugefügte Optionen kann allerdings niemand mehr verändern oder löschen.",
+        "add-option-info": "Wenn Du denkst, eine wichtige Option fehlt noch und ist nicht von den anderen Optionen mit abgedeckt, kannst Du sie bis {{deadline}} hinzufügen. Einmal hinzugefügte Optionen kann allerdings niemand mehr verändern oder löschen.",
         "sorting": "Optionen werden neu sortiert..."
     },
     "previewpoll": {

src/assets/i18n/en.json

@@ -600,7 +600,7 @@
         "average-rating": "avg. wap {{average}}",
         "explain": "Explain",
         "add-option": "Add option",
-        "add-option-info": "If you believe some important option is missing and is not covered by any of the listed options, you can add it. Once added, options cannot be edited or removed again, however.",
+        "add-option-info": "If you believe some important option is missing and is not covered by any of the listed options, you can add it until {{deadline}}. Once added, options cannot be edited or removed again, however.",
         "sorting": "Sorting options by approval...",
         "add-option-expired": "Time to add new options has expired."
     },

src/environments/environment.ts

@@ -55,7 +55,7 @@ export const environment = {
     enabled: false,
     max_weight: 3
   },
-  no_more_options_time_fraction: 1/14,
+  no_more_options_time_fraction: 1/2,
   db_put_retry_delay_ms: 100,
   default_lang: "en",
   github_url: "https://github.com/pik-gane/vodle/",