From 73b647d186ff4e53125801997d097afca28a99e4 Mon Sep 17 00:00:00 2001
From: CamilleBeau <51176779+CamilleBeau@users.noreply.github.com>
Date: Wed, 15 Jul 2020 13:08:57 -0400
Subject: [PATCH] [timepoint_list] Hiding Candidate Info and View Imaging
 Datasets buttons (#6815)

This hides the "Candidate Info" and "View Imaging Datasets" buttons along with the "Create time point" button when the necessary permissions are not present. This was done with the assumption that "View Imaging Datasets" should only be visible if the user has one of the four imaging browser permissions (please correct me if this assumption is wrong). Test plan documentation was edited accordingly. If the user has none of the relevant permissions, the "Actions:" label is also hidden.

    Resolves #6673
---
 .../php/timepoint_list_controlpanel.class.inc    |  9 +++++++++
 .../templates/menu_timepoint_list.tpl            | 12 ++----------
 .../templates/timepoint_list_controlpanel.tpl    | 16 +++++++++++++---
 modules/timepoint_list/test/TestPlan.md          |  2 +-
 4 files changed, 25 insertions(+), 14 deletions(-)

diff --git a/modules/timepoint_list/php/timepoint_list_controlpanel.class.inc b/modules/timepoint_list/php/timepoint_list_controlpanel.class.inc
index 9bd30f99854..f77c0d4c793 100644
--- a/modules/timepoint_list/php/timepoint_list_controlpanel.class.inc
+++ b/modules/timepoint_list/php/timepoint_list_controlpanel.class.inc
@@ -65,6 +65,15 @@ Class TimePoint_List_ControlPanel extends \Candidate
         $this->tpl_data['isDataEntryPerson']
             = $user->hasCenterPermission("data_entry", $cand_CenterID);
 
+        $this->tpl_data['isImagingPerson'] = $user->hasAnyPermission(
+            [
+                'imaging_browser_view_site',
+                'imaging_browser_view_allsites',
+                'imaging_browser_phantom_allsites',
+                'imaging_browser_phantom_ownsite'
+            ]
+        );
+
         //set the baseurl of the tpl_data
         $factory  = \NDB_Factory::singleton();
         $settings = $factory->settings();
diff --git a/modules/timepoint_list/templates/menu_timepoint_list.tpl b/modules/timepoint_list/templates/menu_timepoint_list.tpl
index 7b859b246b5..507a369498f 100644
--- a/modules/timepoint_list/templates/menu_timepoint_list.tpl
+++ b/modules/timepoint_list/templates/menu_timepoint_list.tpl
@@ -51,15 +51,7 @@
 </table>
 
 <div class="col-xs-12 row">
-    <!-- <div class="col-xs-1"> -->
-        <h3>Actions:&nbsp&nbsp</h3> 
-    <!-- </div> -->
-    <!-- <div class="col-xs-4"> -->
-        {$actions}
-           <a class="btn btn-default" role="button" href="{$baseurl}/imaging_browser/?DCCID={$candID}">
-              View Imaging datasets</a>
-
-    <!-- </div> -->
+    {$actions}
 </div>
 <br>
 <br>
@@ -129,7 +121,7 @@
                 <img alt="Data Missing" src="{$baseurl}/images/help2.gif" border=0>
             {/if}
             </td>
-   
+
             <td bgColor="{$timePoints[timepoint].feedbackColor}">
             {if $timePoints[timepoint].feedbackCount}
                 {$timePoints[timepoint].feedbackStatus}
diff --git a/modules/timepoint_list/templates/timepoint_list_controlpanel.tpl b/modules/timepoint_list/templates/timepoint_list_controlpanel.tpl
index a1ab48acfde..f33fdc74121 100644
--- a/modules/timepoint_list/templates/timepoint_list_controlpanel.tpl
+++ b/modules/timepoint_list/templates/timepoint_list_controlpanel.tpl
@@ -1,4 +1,14 @@
-{if $isDataEntryPerson}
-<a class="btn btn-default" role="button" href="{$baseurl}/create_timepoint/?candID={$candID}&identifier={$candID}">Create time point</a>
+{if $isDataEntryPerson || $isImagingPerson}
+    <!-- <div class="col-xs-1"> -->
+        <h3>Actions:&nbsp&nbsp</h3>
+    <!-- </div> -->
+    <!-- <div class="col-xs-4"> -->
+    {if $isDataEntryPerson}
+        <a class="btn btn-default" role="button" href="{$baseurl}/create_timepoint/?candID={$candID}&identifier={$candID}">Create time point</a>
+        <a class="btn btn-default" role="button" href="{$baseurl}/candidate_parameters/?candID={$candID}&identifier={$candID}">Candidate Info</a>
+    {/if}
+    {if $isImagingPerson}
+        <a class="btn btn-default" role="button" href="{$baseurl}/imaging_browser/?DCCID={$candID}">View Imaging datasets</a>
+    {/if}
+    <!-- </div> -->
 {/if}
-<a class="btn btn-default" role="button" href="{$baseurl}/candidate_parameters/?candID={$candID}&identifier={$candID}">Candidate Info</a>
diff --git a/modules/timepoint_list/test/TestPlan.md b/modules/timepoint_list/test/TestPlan.md
index d0268f1b6ea..7e9a020ce34 100644
--- a/modules/timepoint_list/test/TestPlan.md
+++ b/modules/timepoint_list/test/TestPlan.md
@@ -10,7 +10,7 @@
     - For a candidate of the same site as your user, there should be up to 3 additional buttons:
         1. "Create time point" (links to create_timepoint module for that candidate) if your user has permission `data_entry`
         2. "Candidate Info" (links to candidate_parameters module for that candidate) if your user has permission `data_entry`
-        3. "View Imaging Datasets" (links to the imaging_browser module menu page filtered for that candidate)
+        3. "View Imaging Datasets" (links to the imaging_browser module menu page filtered for that candidate) if your user has permission `imaging_browser_view_site`, `imaging_browser_view_allsites`, `imaging_browser_phantom_allsites`, or `imaging_browser_phantom_ownsite`
 3.  **Button links**
     - Ensure the "View Imaging datasets" button points to correct place. (imaging_browser module for that candidate)
     - Ensure the "Create time point" button points to correct place. (create_timepoint module for that candidate)