Forms actions fix (#6493)

* Handle case where OPTIONS.actions is not present

* Specify stock.change permission

* Hide table button based on user permission

* Fix for permission check class

InvenTree/InvenTree/permissions.py

@@ -69,6 +69,10 @@ class RolePermission(permissions.BasePermission):
 
         # The required role may be defined for the view class
         if role := getattr(view, 'role_required', None):
+            # If the role is specified as "role.permission", split it
+            if '.' in role:
+                role, permission = role.split('.')
+
             return users.models.check_user_role(user, role, permission)
 
         try:

InvenTree/stock/api.py

@@ -123,6 +123,8 @@ class StockDetail(RetrieveUpdateDestroyAPI):
 class StockItemContextMixin:
     """Mixin class for adding StockItem object to serializer context."""
 
+    role_required = 'stock.change'
+
     queryset = StockItem.objects.none()
 
     def get_serializer_context(self):

InvenTree/stock/templates/stock/item.html

@@ -196,6 +196,7 @@
             stock_item: {{ item.pk }},
             part: {{ item.part.pk }},
             quantity: {{ item.quantity|unlocalize }},
+            can_edit: {% js_bool roles.stock.change %},
         }
     );
 

InvenTree/templates/js/translated/forms.js

@@ -346,7 +346,11 @@ function constructForm(url, options={}) {
     getApiEndpointOptions(url, function(OPTIONS) {
 
         // Copy across entire actions struct
-        options.actions = OPTIONS.actions.POST || OPTIONS.actions.PUT || OPTIONS.actions.PATCH || OPTIONS.actions.DELETE || {};
+        if (OPTIONS && OPTIONS.actions) {
+            options.actions = OPTIONS.actions.POST || OPTIONS.actions.PUT || OPTIONS.actions.PATCH || OPTIONS.actions.DELETE || {};
+        } else {
+            options.actions = {};
+        }
 
         // Extract any custom 'context' information from the OPTIONS data
         options.context = OPTIONS.context || {};

InvenTree/templates/js/translated/stock.js

@@ -3101,11 +3101,14 @@ function loadInstalledInTable(table, options) {
                 field: 'buttons',
                 title: '',
                 switchable: false,
+                visible: options.can_edit,
                 formatter: function(value, row) {
                     let pk = row.pk;
                     let html = '';
 
-                    html += makeIconButton('fa-unlink', 'button-uninstall', pk, '{% trans "Uninstall Stock Item" %}');
+                    if (options.can_edit) {
+                        html += makeIconButton('fa-unlink', 'button-uninstall', pk, '{% trans "Uninstall Stock Item" %}');
+                    }
 
                     return wrapButtons(html);
                 }