From f2bd5d8e48ff905cd1d41825a10f626980616327 Mon Sep 17 00:00:00 2001
From: Colin Kuskie <colink@perldreamer.com>
Date: Fri, 17 Jul 2009 21:01:55 +0000
Subject: [PATCH] The shelf now checks for viewing permissions of the products
 and shelves that it displays. Template with i18n feedback for users.

---
 .../root_import_shelf-default.wgpkg           | Bin 0 -> 1921 bytes
 lib/WebGUI/Asset/Wobject/Shelf.pm             |  49 ++++++-----
 lib/WebGUI/Help/Asset_Shelf.pm                |   2 +
 lib/WebGUI/i18n/English/Asset_Shelf.pm        |  30 ++++++-
 t/Asset/Wobject/Shelf.t                       |  80 ++++++++++++++----
 5 files changed, 123 insertions(+), 38 deletions(-)
 create mode 100644 docs/upgrades/packages-7.7.16/root_import_shelf-default.wgpkg

diff --git a/docs/upgrades/packages-7.7.16/root_import_shelf-default.wgpkg b/docs/upgrades/packages-7.7.16/root_import_shelf-default.wgpkg
new file mode 100644
index 0000000000000000000000000000000000000000..177518f1190cac045927408d4050a7bc7f85377b
GIT binary patch
literal 1921
zcmV-{2Y&b;iwFP!00000|Ls}rPa8KF=X3uGFCQw9N|H->X#$JZQW!|UXrZgN(jw>1
zNn9@W$@cNGssH;P+vl?{xzMtKHcbSn_wv}!`^(SQ=F;Q;+U@q{=K9i-zHY3UYqSPe
zRQ}paQPk<SqmAzR=H?QLqIPF}3Bi`f|K(C)0jkA3rR;LCyj&6?7n8Md@H57l>m5t~
zOC+Op<p1rioBK}li{$Kq6a|hOMcixRA9Xw3XeRz^-Ke{Sz?+Z%d#w03A7Ax{knra-
zD8hy!(=5e`TwtYeJed-vWCQil$4@T|T`Df{n1rt~!80NhC1#;vqdBEms@<E63q_Jw
zhQ#tTHC!|~76im3uWvQ0Mz>KCpbC}Y-^lV|O67zkp2*1c2g(wDZFaRif!rv8_X$qU
z@K~PU_!4$$#@kZerUa?mjQn^G*4?O9EaiD)@DrVC-B2#l<<G5U!MSSLS1k~kjym?z
zgw-os+bzRp;N{6%#xqIh?W!npw+iR%T-{5Jm92B;RDru6R#!jL5jxoYG|;RTnyQK4
zEoqe!YqJ&xObg4kxQ~P-bo6O;HShz!W<<P)j(A}G9Rw0QYwVwM?P@|sI8T-LCYF+@
zf&<$ltbOz4@^|*~!)12V>+bYo^471V@<edObwp>AfXaQEB!rpwk>4^FJkJi2-GnMj
z>Uf$<cthAu=oN|~b0s9p_4rgL0_2Kugo47j0C!6wCFQJng+&u5Q_6l}W&!vr8*H0Z
zKteHRO7K(;wp*EH&?-3SC+%6sFrgAk?)HqTlsHb4PQXeT%61E0+K_~djLIfELFG}(
zvFZyto~SJ}#bQj^s(I>1>)Fj#VamDs{3|8bJ6NdYl`XXVS>GLiBX)Ss)Ygg>0<M_T
zl*m}nOo91M(a>RuCxayKir_tXqu>jf6_}xBe4<P6ipV-CHY`9atud)DI2#W>A23A(
z!&*a}F3WrvLo*q30nO>fE1hH)CZ;P}eVy2557Or9KdW%cd4{Uu5%T1mr4WB~aWSGo
zs*8)k^C5IKXb{F2OD(i6wqZ08WCX$S4uQ%TR6OJ&jEk+HjAf{`aZafBT$xEmap=WK
z9;;f%6|~T8Ve~ZU(MsJ<Ums8JBPbFz$)`hxY5HE9S~wW2TFAVtx^k!1g-*vvin!vu
za)DvpKsZ%Zx~-!IYC*EiIh2mPIxg;^7hGQtyyP-NSG6O1CeU^>%u4k$L1O}&mwmL&
ztHBB+94st1RvqVDRB1p?*aBT}lALi}x_ewqYx#N^)pXKm+v*3Q$}n^ZQ!!1rC8h^7
zsXT%PO*7Mx%<|Al(11rYB^Q3{c>}o~q-X3ZPU)ESV?Yl?*tWA!rXW|8=P<L!L`SqP
zMZBD5HnSWAyMC=n#~@rMj;Tf+umxMsV4X=1--VvDq0C_Bc|~nSRo!z41=-BAGaj`I
zDODHZSkWt@jTuxE!x9$hrkw`*m<+MXlT-qWntBN=n(HG0t>B1(tLw99J`1eTb-BPm
zBW=ca#3WpLk9fFkHL)n7P;@*Kk<yAVLg0JAtLoM?btnOssl}~+oEZsfLZxZ%BLp{Q
zb9FG(h&KK+@vy|8co^4{6c1B!dYS94t3~RcF67{GMvLEgjuMU-S7?H-2m<^(r3O|Y
z#nBb8gboU?i*AlMgJ-9BoxVn7;4V;L)?vXjbTnPgu43bqV9`fIt|q!xUDvQzkCZ5z
z5J43r#Gc^O6D***XAzjG#bZ3R(Ch;l{`~%+-#3%D-#;tP7M>-{90ECJx#;6&&H2->
zHYbCf31;KEbAvu_9B}}sw1ECmXKnN4#@a@2)3Yd$pbnZ58j#EkHZM&!q2)IgrLOqh
z@{(r9T!9FH6#y~J>d4cn)DTl=!z{%B+*A68C9HKjfnaS`ZVnO+oI%L1!UGQ+!16Oa
z(eBnP!vZk4S+l_D{r>*h(cydus66EQv}6xrl_MIJg$rh_2?Jqhz20W8x4zj44rIDd
zYn=SXo#x7LY=jQeN3}8oJORG3*h8E<(it%UdpY6P2TV^s>$xBb4AKu8X&kuBGbSt+
zx0&f|vn<_7AUr*WQ_r6V%6?gQ7Fc`=@FiI?s9^u?MW{d67}o8#(f-{y-xj#n#l!bO
z1&0Lqy)wUo_eIkP6fK5M38gC>Lky4L-1_&yyVc%IY6sfwtM3BpsBXZ{O;wN1U02oe
z7MN^7gM;A}t33d(y#6P^y9{0h72jc2iI&O@I;0PPvz==IU{|aQK&(}^0;8)K>6_rW
z$k?zdYx!59ak0yc$09>*09}p-unBJGA#lZ@`-9&yNTHk=99x%&cPzgL%nA{64b%z|
zpv~R?Dc}tatzvcuME@12>yp!fbdzg$A~U<gk2HnH#iui}e~@3&cY7~S-tCNTdePx4
zHr{{hS5kR;D`CvdPCmdb=0j~Aaxrt<!GlIHX3YoO>VS{ne|LJ_PB7pBmjFsE)Ef`k
zyGi`v_%fnzNw;&jxBGfM{IXXL{X#$e!TIa6uMhEY`-#Vs2cA6e<bfv-EcC!%+tRw&
H03ZMWU01qH

literal 0
HcmV?d00001

diff --git a/lib/WebGUI/Asset/Wobject/Shelf.pm b/lib/WebGUI/Asset/Wobject/Shelf.pm
index 3c13cef0e..545ad24cd 100644
--- a/lib/WebGUI/Asset/Wobject/Shelf.pm
+++ b/lib/WebGUI/Asset/Wobject/Shelf.pm
@@ -288,8 +288,9 @@ sub view {
 	
 	# get other shelves
 	my @childShelves = ();
-	foreach my $child (@{$self->getLineage(['children'],{returnObjects=>1,includeOnlyClasses=>['WebGUI::Asset::Wobject::Shelf']})}) {
-		my $properties = $child->get;
+	SHELF: foreach my $child (@{$self->getLineage(['children'],{returnObjects=>1,includeOnlyClasses=>['WebGUI::Asset::Wobject::Shelf']})}) {
+        next SHELF unless $child->canView;
+		my $properties  = $child->get;
 		$child->{url}   = $child->getUrl;
 		$child->{title} = $child->getTitle;
 		push @childShelves, $child;
@@ -305,30 +306,38 @@ sub view {
 		isa					=> 'WebGUI::Asset::Sku',
 		});
 
+    ##Prescreen to only paginate viewable products
+	my @productIds = List::MoreUtils::uniq(@childSkus, @{$keywordBasedAssetIds});
+    my @products = ();
+    PRODUCT: foreach my $id (@productIds) {
+		my $asset = WebGUI::Asset->newByDynamicClass($session, $id);
+		if (defined $asset && $asset->canView) {
+            push @products, $asset;
+        }
+		else {
+			$session->errorHandler->error(q|Couldn't instanciate SKU with assetId |.$id.q| on shelf with assetId |.$self->getId);
+		}
+    }
+
 	# create paginator
-	my @products = List::MoreUtils::uniq(@childSkus, @{$keywordBasedAssetIds});
 	my $p = WebGUI::Paginator->new($session, $self->getUrl('func=view'));
 	$p->setDataByArrayRef(\@products);
 
 	# generate template variables
-	my @skus = ();
-	foreach my $id (@{$p->getPageData}) {
-		my $asset = WebGUI::Asset->newByDynamicClass($session, $id);
-		if (defined $asset) {
-			my $sku               = $asset->get;
-			$sku->{url}           = $asset->getUrl;
-            $sku->{thumbnailUrl}  = $asset->getThumbnailUrl;
-            $sku->{price}         = sprintf("%.2f", $asset->getPrice);
-            $sku->{addToCartForm} = $asset->getAddToCartForm;
-			push @skus, $sku;
-		}
-		else {
-			$session->errorHandler->error(q|Couldn't instanciate SKU with assetId |.$id.q| on shelf with assetId |.$self->getId);
-		}
-	}
+    my @skus = ();
+    foreach my $asset (@{$p->getPageData}) {
+        my $sku               = $asset->get;
+        $sku->{url}           = $asset->getUrl;
+        $sku->{thumbnailUrl}  = $asset->getThumbnailUrl;
+        $sku->{price}         = sprintf("%.2f", $asset->getPrice);
+        $sku->{addToCartForm} = $asset->getAddToCartForm;
+        push @skus, $sku;
+    }
 	my %var = (
-		shelves		=> \@childShelves,
-		products	=> \@skus,
+		shelves		    => \@childShelves,
+		products	    => \@skus,
+        noViewableSkus  => scalar(@skus)       ? 0 : 1,
+        emptyShelf      => scalar(@productIds) ? 0 : 1,
 		);
 	$p->appendTemplateVars(\%var);
 	
diff --git a/lib/WebGUI/Help/Asset_Shelf.pm b/lib/WebGUI/Help/Asset_Shelf.pm
index 9e67a20db..3cb818b23 100644
--- a/lib/WebGUI/Help/Asset_Shelf.pm
+++ b/lib/WebGUI/Help/Asset_Shelf.pm
@@ -29,6 +29,8 @@ our $HELP = {
 					],
 				},
 			{	name => "templateId", description=>"shelf template help" },
+			{	name => "noViewableSkus", },
+			{	name => "emptyShelf",      },
 		],
 		related => [  
 		],
diff --git a/lib/WebGUI/i18n/English/Asset_Shelf.pm b/lib/WebGUI/i18n/English/Asset_Shelf.pm
index 52aad39ba..5538cdf8d 100644
--- a/lib/WebGUI/i18n/English/Asset_Shelf.pm
+++ b/lib/WebGUI/i18n/English/Asset_Shelf.pm
@@ -46,14 +46,14 @@ our $I18N = {
 	},
 
 	'shelves' => {
-		message 	=> q|A loop containing the list of shelves that are children of this one in the asset tree. Each record in the loop contains all the properties of a shelf.|,
+		message 	=> q|A loop containing the list of shelves that are children of this one in the asset tree. Each record in the loop contains all the properties of a shelf.  Only shelves that the user can see will be in the loop.|,
 		lastUpdated => 0,
 		context		=> q|a template variable|,
 	},
 
 	'products' => {
-		message 	=> q|A loop containing the list of products that match the keywords specified in this shelf. Each record in the loop contains all the properties of the matching sku, plus the following variables.|,
-		lastUpdated => 0,
+		message 	=> q|A loop containing the list of products that match the keywords specified in this shelf, or that are children of this shelf. Only products that the user can see will be in the loop. Each record in the loop contains all the properties of the matching sku, plus the following variables.|,
+		lastUpdated => 1247603018,
 		context		=> q|a template variable|,
 	},
 
@@ -75,6 +75,30 @@ our $I18N = {
 		context		=> q|help for a property|,
 	},
 
+	'noViewableSkus' => {
+		message 	=> q|A boolean which is true if there are no products on this shelf which the current user can view.|,
+		lastUpdated => 0,
+		context		=> q|Template variable help|,
+	},
+
+	'emptyShelf' => {
+		message 	=> q|A boolean which is true if this shelf has any Products at all.|,
+		lastUpdated => 0,
+		context		=> q|Template variable help|,
+	},
+
+	'this shelf is empty' => {
+		message 	=> q|This shelf is empty.|,
+		lastUpdated => 0,
+		context		=> q|template label|,
+	},
+
+	'You do not have permission to view the products on this shelf' => {
+		message 	=> q|You do not have permission to view the products on this shelf.|,
+		lastUpdated => 0,
+		context		=> q|template label|,
+	},
+
 	'assetName' => {
 		message 	=> q|Shelf|,
 		lastUpdated => 0,
diff --git a/t/Asset/Wobject/Shelf.t b/t/Asset/Wobject/Shelf.t
index 4ed68af15..dd0bf23f9 100644
--- a/t/Asset/Wobject/Shelf.t
+++ b/t/Asset/Wobject/Shelf.t
@@ -20,11 +20,13 @@ use Test::More;
 use Test::Deep;
 use Exception::Class;
 use Data::Dumper;
+use JSON;
 
 use WebGUI::Test; # Must use this before any other WebGUI modules
 use WebGUI::Session;
 use WebGUI::Text;
 use WebGUI::Asset::Sku::Product;
+use WebGUI::VersionTag;
 
 #----------------------------------------------------------------------------
 # Init
@@ -33,7 +35,7 @@ my $session         = WebGUI::Test->session;
 #----------------------------------------------------------------------------
 # Tests
 
-my $tests = 55;
+my $tests = 61;
 plan tests => 1 + $tests;
 
 #----------------------------------------------------------------------------
@@ -42,15 +44,14 @@ plan tests => 1 + $tests;
 my $class  = 'WebGUI::Asset::Wobject::Shelf';
 my $loaded = use_ok($class);
 
-my $storage;
 my ($e, $failure);
-my ($shelf, $shelf2);
 
 SKIP: {
 
     skip "Unable to load module $class", $tests unless $loaded;
 
-    $shelf = WebGUI::Asset->getRoot($session)->addChild({className => $class});
+    my $root  = WebGUI::Asset->getRoot($session);
+    my $shelf = $root->addChild({className => $class});
 
     #######################################################################
     #
@@ -383,7 +384,7 @@ SKIP: {
     #
     #######################################################################
 
-    $shelf2 = WebGUI::Asset->getRoot($session)->addChild({className => $class});
+    my $shelf2 = $root->addChild({className => $class});
 
     $pass = 0;
     eval {
@@ -443,15 +444,64 @@ SKIP: {
     $shelf2->purge;
     undef $shelf2;
 
-}
+    ##Clear out this tag so we can do downstream work.
+    my $tag = WebGUI::VersionTag->getWorking($session);
+    $tag->commit;
+    WebGUI::Test->tagsToRollback($tag);
+
+    #######################################################################
+    #
+    # Template variables
+    #
+    #######################################################################
+
+    my $tommy  = WebGUI::User->create($session);
+    my $warden = WebGUI::User->create($session);
+    WebGUI::Test->usersToDelete($tommy, $warden);
+    my $inGroup = WebGUI::Group->new($session, 'new');
+    WebGUI::Test->groupsToDelete($inGroup);
+    $inGroup->addUsers([$tommy->getId]);
+
+    my $testTemplate = $root->addChild({
+        className => 'WebGUI::Asset::Template',
+        template  => q|{ "noViewableSkus":"<tmpl_var noViewableSkus>","emptyShelf":"<tmpl_var emptyShelf>"}|,
+    });
+    my $testShelf = $root->addChild({
+        className  => $class,
+        templateId => $testTemplate->getId,
+    });
+    my $tag2 = WebGUI::VersionTag->getWorking($session);
+    WebGUI::Test->tagsToRollback($tag2);
+    $tag2->commit;
+    $session->user({userId => 1});
+    $testShelf->prepareView;
+    my $json = $testShelf->view;
+    my $vars = eval { from_json($json) };
+    ok(  $vars->{emptyShelf},     'empty shelf: yes');
+    ok(  $vars->{noViewableSkus}, 'viewable skus: none');
+
+    my $privateSku = $testShelf->addChild({
+        className   => 'WebGUI::Asset::Sku::Product',
+        groupIdView => $inGroup->getId,
+        title       => 'Private Product',
+    });
+    my $tag3 = WebGUI::VersionTag->getWorking($session);
+    WebGUI::Test->tagsToRollback($tag3);
+    $tag3->commit;
+
+    $session->user({user => $tommy});
+    $testShelf->prepareView;
+    $json = $testShelf->view;
+    $vars = eval { from_json($json) };
+    ok( !$vars->{emptyShelf},     'empty shelf, no');
+    ok( !$vars->{noViewableSkus}, 'viewable skus: yes for user in group');
+
+    $session->user({user => $warden});
+    $testShelf->prepareView;
+    $json = $testShelf->view;
+    $vars = eval { from_json($json) };
+
+    ok( !$vars->{emptyShelf},     'empty shelf, no');
+    ok(  $vars->{noViewableSkus}, 'viewable skus: none for user not in viewable group');
 
-#----------------------------------------------------------------------------
-# Cleanup
-END {
-    if (defined $shelf and ref $shelf eq $class) {
-        $shelf->purge;
-    }
-    if (defined $shelf2 and ref $shelf2 eq $class) {
-        $shelf2->purge;
-    }
 }