fix(collections): moving a place out of a list needs the same role as deleting it

Moving a saved place to another list takes it out of the source list, but
updatePlace only asked for edit rights there, so an editor could empty a
shared list they may not delete from. The source now takes owner or admin,
like a delete, and the target still takes edit rights. REST and the
update_collection_place tool share the service path. The Move to list
action on desktop and phone follows the delete permission.
This commit is contained in:
Maurice
2026-10-12 09:17:02 +02:00
parent 6c8321cd63
commit aa1bb41cf5
11 changed files with 172 additions and 7 deletions
@@ -383,7 +383,7 @@ export default function MCollections() {
<button type="button" onClick={c.openCopyForSelection} disabled={c.selectedIds.length === 0} className={selectChip(c.selectedIds.length === 0)}>
<Copy size={13} strokeWidth={2.2} /> {t('collections.copyToTrip')}
</button>
{c.canEdit && (
{c.canDelete && (
<button type="button" onClick={() => c.setListPickerMode('move')} disabled={c.selectedIds.length === 0} className={selectChip(c.selectedIds.length === 0)}>
<FolderInput size={13} strokeWidth={2.2} /> {t('collections.moveToList')}
</button>
+1 -1
View File
@@ -277,7 +277,7 @@ function CollectionsPageDesktop(): React.ReactElement {
<Tags size={14} /> {t('collections.labels.assign')}
</button>
)}
{c.canEdit && (
{c.canDelete && (
<button type="button" onClick={() => c.setListPickerMode('move')} disabled={c.selectedIds.length === 0} className="col-selbar-btn">
<FolderInput size={14} /> {t('collections.moveToList')}
</button>
@@ -479,6 +479,15 @@ describe('CollectionsPage — select mode', () => {
expect(screen.getByRole('button', { name: /collections.copyToTrip/ })).toBeInTheDocument()
})
it('FE-PAGE-COLLPAGE-021b: an editor keeps the edit actions but cannot move places out of the list', () => {
renderPage({ ...selecting, canEdit: true, canDelete: false })
expect(screen.queryByRole('button', { name: /collections.moveToList/ })).toBeNull()
expect(screen.queryByRole('button', { name: /common.delete/ })).toBeNull()
expect(screen.getByRole('button', { name: /collections.labels.assign/ })).toBeInTheDocument()
expect(screen.getByRole('button', { name: /collections.duplicateToList/ })).toBeInTheDocument()
expect(screen.getByRole('button', { name: /collections.copyToTrip/ })).toBeInTheDocument()
})
it('FE-PAGE-COLLPAGE-022: bulk buttons are disabled while nothing is selected', () => {
renderPage({ selectMode: true, selectedIds: [] })
expect(screen.getByRole('button', { name: /collections.moveToList/ })).toBeDisabled()