From e04e67774e04a2bacf7b6989a6c40440f7a46a0f Mon Sep 17 00:00:00 2001
From: Lance Edgar <lance@edbob.org>
Date: Mon, 23 Mar 2020 19:33:00 -0500
Subject: [PATCH] Add common permission for sending user feedback

there can be valid reasons to *not* expose that, so let admin decide
---
 tailbone/api/common.py                      |  3 ++-
 tailbone/templates/base.mako                |  4 +++-
 tailbone/templates/themes/falafel/base.mako |  8 +++++---
 tailbone/views/common.py                    | 10 +++++++---
 4 files changed, 17 insertions(+), 8 deletions(-)

diff --git a/tailbone/api/common.py b/tailbone/api/common.py
index 0b752adf..0552b68d 100644
--- a/tailbone/api/common.py
+++ b/tailbone/api/common.py
@@ -119,7 +119,8 @@ class CommonView(APIView):
 
         # feedback
         feedback = Service(name='feedback', path='/feedback')
-        feedback.add_view('POST', 'feedback', klass=cls)
+        feedback.add_view('POST', 'feedback', klass=cls,
+                          permission='common.feedback')
         config.add_cornice_service(feedback)
 
 
diff --git a/tailbone/templates/base.mako b/tailbone/templates/base.mako
index aea0c0e5..daa60e2d 100644
--- a/tailbone/templates/base.mako
+++ b/tailbone/templates/base.mako
@@ -71,7 +71,9 @@
             % if help_url is not Undefined and help_url:
                 ${h.link_to("Help", help_url, target='_blank', class_='button')}
             % endif
-            <button type="button" id="feedback">Feedback</button>
+            % if request.has_perm('common.feedback'):
+                <button type="button" id="feedback">Feedback</button>
+            % endif
           </div>
 
           % if expose_theme_picker and request.has_perm('common.change_app_theme'):
diff --git a/tailbone/templates/themes/falafel/base.mako b/tailbone/templates/themes/falafel/base.mako
index 24f3acf5..713d9547 100644
--- a/tailbone/templates/themes/falafel/base.mako
+++ b/tailbone/templates/themes/falafel/base.mako
@@ -330,9 +330,11 @@
             % endif
 
             ## Feedback Button / Dialog
-            <feedback-form
-               action="${url('feedback')}">
-            </feedback-form>
+            % if request.has_perm('common.feedback'):
+                <feedback-form
+                   action="${url('feedback')}">
+                </feedback-form>
+            % endif
 
           </div><!-- level-right -->
         </nav><!-- level -->
diff --git a/tailbone/views/common.py b/tailbone/views/common.py
index 8aced214..dd02e614 100644
--- a/tailbone/views/common.py
+++ b/tailbone/views/common.py
@@ -2,7 +2,7 @@
 ################################################################################
 #
 #  Rattail -- Retail Software Framework
-#  Copyright © 2010-2019 Lance Edgar
+#  Copyright © 2010-2020 Lance Edgar
 #
 #  This file is part of Rattail.
 #
@@ -229,10 +229,14 @@ class CommonView(View):
         config.add_view(cls, attr='change_theme', route_name='change_theme')
 
         # feedback
+        config.add_tailbone_permission('common', 'common.feedback',
+                                       "Send user feedback (to admins) about the app")
         config.add_route('feedback', '/feedback', request_method='POST')
-        config.add_view(cls, attr='feedback', route_name='feedback', renderer='json')
+        config.add_view(cls, attr='feedback', route_name='feedback',
+                        renderer='json', permission='common.feedback')
         config.add_route('mobile.feedback', '/mobile/feedback', request_method='POST')
-        config.add_view(cls, attr='mobile_feedback', route_name='mobile.feedback', renderer='json')
+        config.add_view(cls, attr='mobile_feedback', route_name='mobile.feedback',
+                        renderer='json', permission='common.feedback')
 
         # consume batch ID
         config.add_tailbone_permission('common', 'common.consume_batch_id',