Give partially and fully shared courses the same deletion behaviour

Fixes #2271 Fixes #2266
adaptlearning · Mar 8, 2019 · 9dbb6c5 · 9dbb6c5
1 parent 57012fc
commit 9dbb6c5
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 7 deletions.
diff --git a/frontend/src/modules/projects/views/projectView.js b/frontend/src/modules/projects/views/projectView.js
@@ -75,8 +75,7 @@ define(function(require) {
 
     deleteProjectPrompt: function(event) {
       event && event.preventDefault();
-      var isAdmin = Origin.permissions.hasPermissions(['*/*:create','*/*:read','*/*:update','*/*:delete']);
-      var isShared = this.model.get('_isShared') === true;
+      var isShared = this.model.get('_isShared') || (this.model.get('_shareWithUsers') && this.model.get('_shareWithUsers').length > 0);
       var titleKey = isShared ? 'deletesharedproject' : 'deleteproject';
       var textKey = isShared ? 'confirmdeletesharedprojectwarning' : 'confirmdeleteprojectwarning';
 

diff --git a/lib/helpers.js b/lib/helpers.js
@@ -152,12 +152,12 @@ function hasCoursePermission (action, userId, tenantId, contentItem, next) {
         if(course.createdBy.toString() === userId) { // user's own course
           return next(null, true);
         }
-        if(course._shareWithUsers && course._shareWithUsers.length) { // check if userId is in _shareWithUsers
-          return next(null, course._shareWithUsers.map(user => user.toString()).includes(userId));
-        }
         if(course._isShared) { // shared with _all_ users
           return next(null, true);
         }
+        if(course._shareWithUsers && course._shareWithUsers.length) { // check if userId is in _shareWithUsers
+          return next(null, course._shareWithUsers.map(user => user.toString()).includes(userId));
+        }
         next();
       });
     });

diff --git a/plugins/content/course/index.js b/plugins/content/course/index.js
@@ -29,7 +29,7 @@ util.inherits(CourseContent, ContentPlugin);
 
 var DASHBOARD_COURSE_FIELDS = [
     '_id', '_tenantId', '_type', '_isShared', 'title', 'heroImage',
-    'updatedAt', 'updatedBy', 'createdAt', 'createdBy', 'tags'
+    'updatedAt', 'updatedBy', 'createdAt', 'createdBy', 'tags', '_shareWithUsers'
 ];
 
 function doQuery(req, res, andOptions, next) {
@@ -320,7 +320,7 @@ CourseContent.prototype.destroy = function (search, force, next) {
       var resource = permissions.buildResourceString(tenantId, '/api/content/course/*');
       permissions.hasPermission(user._id, 'delete', resource, function(error, canDeleteAll) {
         // Final check before deletion
-        if(!canDeleteAll && docs[0]._isShared && docs[0].createdBy != user._id) {
+        if(!canDeleteAll && !docs[0]._isShared && docs[0].createdBy === user._id) {
           return next(new ContentPermissionError());
         }
         // Courses use cascading delete