fix: скрыть админские действия статей от студентов

web/src/main/resources/templates/learn/section.html

@@ -44,7 +44,7 @@
 
     <div class="card card-flush">
         <table>
-            <thead><tr><th>Статья</th><th class="th-w-md" data-nosort>Действия</th></tr></thead>
+            <thead><tr><th>Статья</th><th class="th-w-md" data-nosort th:if="${currentUser != null and currentUser.admin}">Действия</th></tr></thead>
             <tbody data-article-list>
             <tr th:each="article : ${section.articles}" th:attr="data-article-id=${article.id}">
                 <td>
@@ -55,7 +55,7 @@
                        th:text="${article.title}">—</a>
                     <span th:if="${!article.published}" class="badge badge-warn ml-1">скрыто</span>
                 </td>
-                <td class="text-right actions-cell">
+                <td class="text-right actions-cell" th:if="${currentUser != null and currentUser.admin}">
                     <a class="btn btn-secondary btn-sm p-2" title="Править статью" aria-label="Править статью"
                        th:href="@{/learn/{c}/{s}/{a}(c=${chapter.slug}, s=${section.slug}, a=${article.slug}, edit=1)}"><i class="ico bi bi-pencil" aria-hidden="true"></i></a>
                     <form class="inline-form" th:action="@{/admin/content/articles/toggle-published}" method="post">
@@ -73,7 +73,7 @@
                     </form>
                 </td>
             </tr>
-            <tr th:if="${#lists.isEmpty(section.articles)}"><td colspan="2" class="empty">Статей пока нет.</td></tr>
+            <tr th:if="${#lists.isEmpty(section.articles)}"><td th:colspan="${currentUser != null and currentUser.admin} ? 2 : 1" class="empty">Статей пока нет.</td></tr>
             </tbody>
         </table>
     </div>
@@ -118,7 +118,7 @@
         </div>
     </dialog>
 
-    <dialog id="modal-new-article" class="dlg">
+    <dialog id="modal-new-article" class="dlg" th:if="${currentUser != null and currentUser.admin}">
         <div class="dlg-header">
             <h2 class="dlg-title">Новая статья в разделе</h2>
             <button class="dlg-close" type="button" aria-label="Закрыть">✕</button>
@@ -143,7 +143,9 @@
         </div>
     </dialog>
 
+    <th:block th:if="${currentUser != null and currentUser.admin}">
         <script th:src="@{/js/content-sort.js(v='36')}" defer></script>
+    </th:block>
 </div>
 </body>
 </html>

web/src/test/kotlin/ru/ysu/lms/web/learn/LearnSectionTemplateTest.kt

@@ -0,0 +1,106 @@
+package ru.ysu.lms.web.learn
+
+import org.assertj.core.api.Assertions.assertThat
+import org.junit.jupiter.api.Test
+import org.springframework.mock.web.MockHttpServletRequest
+import org.springframework.mock.web.MockHttpServletResponse
+import org.springframework.mock.web.MockServletContext
+import org.thymeleaf.context.WebContext
+import org.thymeleaf.spring6.SpringTemplateEngine
+import org.thymeleaf.templatemode.TemplateMode
+import org.thymeleaf.templateresolver.ClassLoaderTemplateResolver
+import org.thymeleaf.web.servlet.JakartaServletWebApplication
+import ru.ysu.lms.web.session.SessionUser
+import java.util.Locale
+
+class LearnSectionTemplateTest {
+    private val engine =
+        SpringTemplateEngine().apply {
+            setTemplateResolver(
+                ClassLoaderTemplateResolver().apply {
+                    prefix = "templates/"
+                    suffix = ".html"
+                    characterEncoding = "UTF-8"
+                    templateMode = TemplateMode.HTML
+                },
+            )
+        }
+
+    @Test
+    fun `student does not see article admin actions`() {
+        val html = render("STUDENT")
+
+        assertThat(html).contains("Статья 1")
+        assertThat(html).doesNotContain("Удалить статью")
+        assertThat(html).doesNotContain("Править статью")
+        assertThat(html).doesNotContain("Скрыть статью")
+        assertThat(html).doesNotContain("modal-new-article")
+        assertThat(html).doesNotContain(">Действия</th>")
+    }
+
+    @Test
+    fun `admin sees article actions`() {
+        val html = render("ADMIN")
+
+        assertThat(html).contains("Статья 1")
+        assertThat(html).contains("Удалить статью")
+        assertThat(html).contains("Править статью")
+        assertThat(html).contains("Скрыть статью")
+        assertThat(html).contains("modal-new-article")
+        assertThat(html).contains(">Действия</th>")
+    }
+
+    private fun render(role: String): String {
+        val servletContext = MockServletContext()
+        val application = JakartaServletWebApplication.buildApplication(servletContext)
+        val exchange =
+            application.buildExchange(
+                MockHttpServletRequest(servletContext),
+                MockHttpServletResponse(),
+            )
+        val context = WebContext(exchange, Locale.forLanguageTag("ru"))
+        context.setVariable("csrfToken", "csrf")
+        context.setVariable(
+            "currentUser",
+            SessionUser(
+                id = "user-1",
+                login = role.lowercase(),
+                role = role,
+                name = "Пользователь",
+                mustChangePassword = false,
+            ),
+        )
+        context.setVariable(
+            "chapter",
+            mapOf(
+                "slug" to "chapter-1",
+                "title" to "Глава",
+            ),
+        )
+        context.setVariable(
+            "section",
+            mapOf(
+                "id" to "section-1",
+                "slug" to "section-1",
+                "title" to "Раздел",
+                "published" to true,
+                "articles" to
+                    listOf(
+                        mapOf(
+                            "id" to "article-1",
+                            "title" to "Статья 1",
+                            "slug" to "article-1",
+                            "published" to true,
+                        ),
+                    ),
+            ),
+        )
+        context.setVariable("back", "/learn/chapter-1")
+        context.setVariable("backParent", "/learn")
+        context.setVariable(
+            "sectionChoices",
+            listOf(mapOf("id" to "section-2", "chapterId" to "chapter-1", "label" to "Глава / Раздел 2")),
+        )
+        return engine.process("learn/section", context)
+    }
+}