Fix permissions on project page

client/cypress/integration/frontend/portfolio/project-page.spec.js

@@ -144,6 +144,24 @@ describe('Project Page', () => {
     cy.getByDataCy('project-share-link').should('contain', unsharedText);
   });
 
+  it('cannot edit or delete the project as a teacher', () => {
+    cy.mockGraphqlOps({
+      operations: {
+        ...operations,
+        MeQuery: {
+          me: {
+            id: 'not-the-same',
+            isTeacher: true
+          },
+        },
+      },
+    });
+    cy.visit('/portfolio/groot');
+    cy.getByDataCy('project-actions').should('not.exist');
+    cy.getByDataCy('project-entry').should('have.length', 1);
+    cy.getByDataCy('project-entry-more').should('not.exist');
+  });
+
   describe('Project Entry', () => {
     it('should create a new project entry', () => {
       cy.visit('/portfolio');

client/src/graphql/client.js

@@ -107,7 +107,6 @@ export default function (uri, networkErrorCallback) {
         objectiveGroup: (_, args, {getCacheKey}) => getCacheKey({__typename: 'ObjectiveGroupNode', id: args.id}),
         projectEntry: (_, args, {getCacheKey}) => getCacheKey({__typename: 'ProjectEntryNode', id: args.id}),
         project: (_, args, {getCacheKey}) => {
-          console.log(args);
           if (args.slug) {
             return getCacheKey({__typename: 'ProjectNode', id: args.slug});
           } else {

client/src/pages/portfolio/project.vue

@@ -13,13 +13,13 @@
           :final="project.final"
           data-cy="project-share-link"
           class="project__share"
-          @click.native="updateProjectShareState(project.id, !project.final)" />
+          @click.native="updateProjectShareState(project.id, !project.final)"/>
 
         <project-actions
           :id="project.id"
           :share-buttons="false"
           class="project__more"
-          v-if="!me.readOnly && !me.selectedClass.readOnly"/>
+          v-if="canEdit"/>
 
       </div>
 
@@ -45,7 +45,7 @@
       <project-entry
         v-bind="entry"
         :key="index"
-        :read-only="me.readOnly || me.selectedClass.readOnly"
+        :read-only="!canEdit"
         v-for="(entry, index) in project.entries"/>
     </div>
   </div>
@@ -109,6 +109,9 @@
       projectEntryCount() {
         return this.project.entries ? this.project.entries.length : 0;
       },
+      canEdit() {
+        return !this.me.readOnly && !this.me.selectedClass.readOnly && this.isOwner;
+      },
     },
 
     apollo: {