From d9abb62e4b681ae1e7b030be5aafbbf9cf0699a0 Mon Sep 17 00:00:00 2001
From: Regis Freyd <djaiss@users.noreply.github.com>
Date: Tue, 20 Oct 2020 15:45:28 -0400
Subject: [PATCH] chore: fix permissions on summary project page

---
 .../Company/Project/ProjectController.php     |   2 +-
 resources/js/Pages/Project/Members/Index.vue  | 124 +++++++++---------
 .../Pages/Project/Partials/ProjectUpdates.vue |   2 +-
 3 files changed, 65 insertions(+), 63 deletions(-)

diff --git a/app/Http/Controllers/Company/Project/ProjectController.php b/app/Http/Controllers/Company/Project/ProjectController.php
index e90a77302..80711542a 100644
--- a/app/Http/Controllers/Company/Project/ProjectController.php
+++ b/app/Http/Controllers/Company/Project/ProjectController.php
@@ -574,7 +574,7 @@ public function createStatus(Request $request, int $companyId, int $projectId)
         }
 
         if ($project->lead) {
-            if ($project->lead->id != $employee->id) {
+            if ($project->lead->id != $employee->id && $employee->permission_level > 200) {
                 return redirect('home');
             }
         }
diff --git a/resources/js/Pages/Project/Members/Index.vue b/resources/js/Pages/Project/Members/Index.vue
index 15f1868c5..631e6eb4f 100644
--- a/resources/js/Pages/Project/Members/Index.vue
+++ b/resources/js/Pages/Project/Members/Index.vue
@@ -94,75 +94,77 @@
             </div>
 
             <!-- add a new member -->
-            <div v-if="showModal" class="pa3 bg-white box mb3">
+            <div v-if="showModal" class="bg-white box mb3">
               <form @submit.prevent="submit">
-                <div class="measure">
-                  <h2 class="mt0 fw4 f4">
-                    {{ $t('project.members_index_add_title') }}
-                  </h2>
-
-                  <!-- employee -->
-                  <select-box :id="'employee'"
-                              v-model="form.employee"
-                              :options="potentialMembers"
-                              :name="'employee'"
-                              :errors="$page.props.errors.employee"
-                              :label="$t('project.members_index_add_select_title')"
-                              :placeholder="$t('project.members_index_add_select_placeholder')"
-                              :required="true"
-                              :value="form.employee"
-                              :datacy="'members_selector'"
-                  />
-                  <p class="lh-copy">{{ $t('project.members_index_add_role') }}</p>
-
-                  <!-- choose role (optional) -->
-                  <ul :class="showNewRoleInputField ? 'mb0' : 'mb3'" class="list pl0 ma0">
-                    <!-- no role -->
-                    <li>
-                      <input id="no-role" type="radio" name="roles" class="mr1 relative" checked
-                             @click="setNoRole()"
-                      />
-                      <label for="no-role" class="pointer">
-                        {{ $t('project.members_index_add_role_no_role') }}
-                      </label>
-                    </li>
-                    <!-- existing roles -->
-                    <li v-for="role in localRoles" :key="role.id" @click="showNewRoleInputField = false">
-                      <input :id="'role_' + role.id" v-model="form.role" type="radio" class="mr1 relative"
-                             :value="role.role" name="roles"
-                      />
-                      <label :for="'role_' + role.id" class="pointer">
-                        {{ role.role }}
-                      </label>
-                    </li>
+                <h2 class="mv0 fw4 f4 pa3 bb bb-gray">
+                  {{ $t('project.members_index_add_title') }}
+                </h2>
+
+                <div class="pa3 bb bb-gray">
+                  <div class="measure">
+                    <!-- employee -->
+                    <select-box :id="'employee'"
+                                v-model="form.employee"
+                                :options="potentialMembers"
+                                :name="'employee'"
+                                :errors="$page.props.errors.employee"
+                                :label="$t('project.members_index_add_select_title')"
+                                :placeholder="$t('project.members_index_add_select_placeholder')"
+                                :required="true"
+                                :value="form.employee"
+                                :datacy="'members_selector'"
+                    />
+                    <p class="lh-copy">{{ $t('project.members_index_add_role') }}</p>
+
+                    <!-- choose role (optional) -->
+                    <ul :class="showNewRoleInputField ? 'mb0' : 'mb3'" class="list pl0 ma0">
+                      <!-- no role -->
+                      <li>
+                        <input id="no-role" type="radio" name="roles" class="mr1 relative" checked
+                               @click="setNoRole()"
+                        />
+                        <label for="no-role" class="pointer">
+                          {{ $t('project.members_index_add_role_no_role') }}
+                        </label>
+                      </li>
+                      <!-- existing roles -->
+                      <li v-for="role in localRoles" :key="role.id" @click="showNewRoleInputField = false">
+                        <input :id="'role_' + role.id" v-model="form.role" type="radio" class="mr1 relative"
+                               :value="role.role" name="roles"
+                        />
+                        <label :for="'role_' + role.id" class="pointer">
+                          {{ role.role }}
+                        </label>
+                      </li>
+
+                      <!-- custom role -->
+                      <li>
+                        <input id="new-role" type="radio" name="roles" class="mr1 relative" value="new"
+                               data-cy="custom-role-field" @click="displayNewRoleInput()"
+                        />
+                        <label for="new-role" class="pointer">
+                          {{ $t('project.members_index_add_role_create_new_one') }}
+                        </label>
+                      </li>
+                    </ul>
 
                     <!-- custom role -->
-                    <li>
-                      <input id="new-role" type="radio" name="roles" class="mr1 relative" value="new"
-                             data-cy="custom-role-field" @click="displayNewRoleInput()"
+                    <div v-if="showNewRoleInputField" class="pl3">
+                      <!-- role -->
+                      <text-input :id="'role'"
+                                  :ref="'newRole'"
+                                  v-model="form.role"
+                                  :datacy="'customRole'"
+                                  :name="'role'"
+                                  :errors="$page.props.errors.role"
+                                  :required="true"
                       />
-                      <label for="new-role" class="pointer">
-                        {{ $t('project.members_index_add_role_create_new_one') }}
-                      </label>
-                    </li>
-                  </ul>
-
-                  <!-- custom role -->
-                  <div v-if="showNewRoleInputField" class="pl3">
-                    <!-- role -->
-                    <text-input :id="'role'"
-                                :ref="'newRole'"
-                                v-model="form.role"
-                                :datacy="'customRole'"
-                                :name="'role'"
-                                :errors="$page.props.errors.role"
-                                :required="true"
-                    />
+                    </div>
                   </div>
                 </div>
 
                 <!-- Actions -->
-                <div class="cf flex-ns">
+                <div class="pa3 cf flex-ns">
                   <loading-button :classes="'btn add mr2 w-auto-ns w-100 pv2 ph3 db dib-ns mb3 mb0-ns'" :state="loadingState" :text="$t('app.save')" :cypress-selector="'submit-add-member'" />
                   <a class="btn dib-ns db tc w-auto-ns w-100 pv2 ph3 mb0-ns mb2" data-cy="cancel-button" @click.prevent="showModal = false">
                     {{ $t('app.cancel') }}
diff --git a/resources/js/Pages/Project/Partials/ProjectUpdates.vue b/resources/js/Pages/Project/Partials/ProjectUpdates.vue
index 4f91bbaf9..6e7e7532d 100644
--- a/resources/js/Pages/Project/Partials/ProjectUpdates.vue
+++ b/resources/js/Pages/Project/Partials/ProjectUpdates.vue
@@ -5,7 +5,7 @@
   <div>
     <div class="bg-white box mb4">
       <!-- title + status -->
-      <div class="pv2 ph3 fw5 flex justify-between items-center">
+      <div class="pv3 ph3 fw5 flex justify-between items-center">
         <!-- if a status is already defined -->
         <div v-if="project.latest_update">
           <p v-if="project.latest_update.status == 'on_track'" class="ma0"><span class="mr1">😇</span> {{ $t('project.summary_project_latest_update_on_track') }}</p>