From 46e991d5faca14d5992c0839df419f800a1c7c5a Mon Sep 17 00:00:00 2001
From: Carine Dengler <git@carine-dengler.de>
Date: Wed, 31 Jan 2024 22:25:00 +0100
Subject: [PATCH] fix: show 'Decrypt' button only to owner

---
 .../ActionButtons/DecryptButton.tsx           |  9 ++++---
 .../form/components/utils/useChangeAction.tsx |  8 ++++++-
 web/frontend/tests/forms.spec.ts              | 24 ++++++++++++++-----
 3 files changed, 29 insertions(+), 12 deletions(-)

diff --git a/web/frontend/src/pages/form/components/ActionButtons/DecryptButton.tsx b/web/frontend/src/pages/form/components/ActionButtons/DecryptButton.tsx
index 377b58df8..65242a181 100644
--- a/web/frontend/src/pages/form/components/ActionButtons/DecryptButton.tsx
+++ b/web/frontend/src/pages/form/components/ActionButtons/DecryptButton.tsx
@@ -4,15 +4,14 @@ import { useContext } from 'react';
 import { useTranslation } from 'react-i18next';
 import { OngoingAction, Status } from 'types/form';
 import ActionButton from './ActionButton';
+import { isManager } from './utils';
 
-const SUBJECT_ELECTION = 'election';
-const ACTION_CREATE = 'create';
-const DecryptButton = ({ status, handleDecrypt, ongoingAction }) => {
-  const authCtx = useContext(AuthContext);
+const DecryptButton = ({ status, handleDecrypt, ongoingAction, formID }) => {
+  const { authorization, isLogged } = useContext(AuthContext);
   const { t } = useTranslation();
 
   return (
-    authCtx.isAllowed(SUBJECT_ELECTION, ACTION_CREATE) &&
+    isManager(formID, authorization, isLogged) &&
     status === Status.ShuffledBallots && (
       <ActionButton
         handleClick={handleDecrypt}
diff --git a/web/frontend/src/pages/form/components/utils/useChangeAction.tsx b/web/frontend/src/pages/form/components/utils/useChangeAction.tsx
index 74f55fb3c..e81ff4042 100644
--- a/web/frontend/src/pages/form/components/utils/useChangeAction.tsx
+++ b/web/frontend/src/pages/form/components/utils/useChangeAction.tsx
@@ -508,7 +508,12 @@ const useChangeAction = (
       case Status.Setup:
         return (
           <>
-            <OpenButton status={status} handleOpen={handleOpen} ongoingAction={ongoingAction} formID={formID} />
+            <OpenButton
+              status={status}
+              handleOpen={handleOpen}
+              ongoingAction={ongoingAction}
+              formID={formID}
+            />
             <DeleteButton handleDelete={handleDelete} formID={formID} />
             <AddVotersButton handleAddVoters={handleAddVoters} formID={formID} />
           </>
@@ -552,6 +557,7 @@ const useChangeAction = (
               status={status}
               handleDecrypt={handleDecrypt}
               ongoingAction={ongoingAction}
+              formID={formID}
             />
             <DeleteButton handleDelete={handleDelete} formID={formID} />
           </>
diff --git a/web/frontend/tests/forms.spec.ts b/web/frontend/tests/forms.spec.ts
index a2920aa59..3648a74ef 100644
--- a/web/frontend/tests/forms.spec.ts
+++ b/web/frontend/tests/forms.spec.ts
@@ -62,7 +62,13 @@ async function assertIsOnlyVisibleToOwner(page: page, locator: locator) {
   });
 }
 
-async function assertIsOnlyVisibleToOwnerStates(page: page, locator: locator, states: Array, dkgActorsStatus?: number, initialized?: boolean) {
+async function assertIsOnlyVisibleToOwnerStates(
+  page: page,
+  locator: locator,
+  states: Array,
+  dkgActorsStatus?: number,
+  initialized?: boolean
+) {
   for (const i of states) {
     await test.step(`Assert is only visible to owner in state ${i}`, async () => {
       await setUpMocks(page, i, dkgActorsStatus === undefined ? 6 : dkgActorsStatus, initialized);
@@ -97,11 +103,9 @@ test('Assert "Setup" button is only visible to owner', async ({ page }) => {
 });
 
 test('Assert "Open" button is only visible to owner', async ({ page }) => {
-  await assertIsOnlyVisibleToOwnerStates(
-    page,
-    page.getByRole('button', { name: i18n.t('open') }),
-    [0]
-  );
+  await assertIsOnlyVisibleToOwnerStates(page, page.getByRole('button', { name: i18n.t('open') }), [
+    0,
+  ]);
 });
 
 test('Assert "Cancel" button is only visible to owner', async ({ page }) => {
@@ -128,6 +132,14 @@ test('Assert "Shuffle" button is only visible to owner', async ({ page }) => {
   );
 });
 
+test('Assert "Decrypt" button is only visible to owner', async ({ page }) => {
+  await assertIsOnlyVisibleToOwnerStates(
+    page,
+    page.getByRole('button', { name: i18n.t('decrypt') }),
+    [3]
+  );
+});
+
 test('Assert "Combine" button is only visible to owner', async ({ page }) => {
   await assertIsOnlyVisibleToOwnerStates(
     page,