From a23bb946700cc6f603c227349e2c7b9a33c2d087 Mon Sep 17 00:00:00 2001
From: "brian.mulier" <bmmulier@hotmail.fr>
Date: Wed, 26 Jul 2023 16:38:59 +0200
Subject: [PATCH] fix(core): acl control added on 'Use' buttons in
 BlueprintsBrowser & BlueprintDetail

closes #1816
---
 .../components/flows/blueprints/BlueprintDetail.vue   |  9 ++++++++-
 .../components/flows/blueprints/BlueprintsBrowser.vue | 11 ++++++++++-
 2 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/ui/src/components/flows/blueprints/BlueprintDetail.vue b/ui/src/components/flows/blueprints/BlueprintDetail.vue
index f30749c53b1..56871259bae 100644
--- a/ui/src/components/flows/blueprints/BlueprintDetail.vue
+++ b/ui/src/components/flows/blueprints/BlueprintDetail.vue
@@ -11,7 +11,7 @@
                     <h2 class="blueprint-title align-self-center">
                         {{ blueprint.title }}
                     </h2>
-                    <div class="ms-auto align-self-center">
+                    <div v-if="userCanCreateFlow" class="ms-auto align-self-center">
                         <router-link :to="{name: 'flows/create'}" @click="asAutoRestoreDraft">
                             <el-button size="large" type="primary" v-if="!embed">
                                 {{ $t('use') }}
@@ -93,6 +93,9 @@
     import {shallowRef} from "vue";
     import ContentCopy from "vue-material-design-icons/ContentCopy.vue";
     import Markdown from "../../layout/Markdown.vue";
+    import {mapState} from "vuex";
+    import permission from "../../../models/permission";
+    import action from "../../../models/action";
 
 
     export default {
@@ -158,6 +161,10 @@
             }
         },
         computed: {
+            ...mapState("auth", ["user"]),
+            userCanCreateFlow() {
+                return this.user.hasAnyAction(permission.FLOW, action.CREATE);
+            },
             parsedFlow() {
                 return {
                     ...YamlUtils.parse(this.blueprint.flow),
diff --git a/ui/src/override/components/flows/blueprints/BlueprintsBrowser.vue b/ui/src/override/components/flows/blueprints/BlueprintsBrowser.vue
index e5e04741ebf..c44df698f8d 100644
--- a/ui/src/override/components/flows/blueprints/BlueprintsBrowser.vue
+++ b/ui/src/override/components/flows/blueprints/BlueprintsBrowser.vue
@@ -56,7 +56,7 @@
                                     {{ $t('copy') }}
                                 </el-button>
                             </el-tooltip>
-                            <el-button v-else size="large" text bg @click="blueprintToEditor(blueprint.id)">
+                            <el-button v-else-if="userCanCreateFlow" size="large" text bg @click="blueprintToEditor(blueprint.id)">
                                 {{ $t('use') }}
                             </el-button>
                         </div>
@@ -76,6 +76,9 @@
     import {shallowRef} from "vue";
     import ContentCopy from "vue-material-design-icons/ContentCopy.vue";
     import RestoreUrl from "../../../../mixins/restoreUrl";
+    import permission from "../../../../models/permission";
+    import action from "../../../../models/action";
+    import {mapState} from "vuex";
 
     export default {
         mixins: [RestoreUrl, DataTableActions],
@@ -198,6 +201,12 @@
                 this.load(this.onDataLoaded);
             }
         },
+        computed: {
+            ...mapState("auth", ["user"]),
+            userCanCreateFlow() {
+                return this.user.hasAnyAction(permission.FLOW, action.CREATE);
+            }
+        },
         watch: {
             $route(newValue, oldValue) {
                 if (oldValue.name === newValue.name) {