From b4adf697e9edaff1235e582e17fa82f31b4b7194 Mon Sep 17 00:00:00 2001
From: Carine Dengler <git@carine-dengler.de>
Date: Wed, 31 Jan 2024 22:05:40 +0100
Subject: [PATCH] fix: show 'Initialize' button only to owner

---
 .../form/components/ActionButtons/InitializeButton.tsx | 10 +++++-----
 .../pages/form/components/utils/useChangeAction.tsx    |  1 +
 web/frontend/tests/forms.spec.ts                       | 10 ++++++++++
 3 files changed, 16 insertions(+), 5 deletions(-)

diff --git a/web/frontend/src/pages/form/components/ActionButtons/InitializeButton.tsx b/web/frontend/src/pages/form/components/ActionButtons/InitializeButton.tsx
index 20788e7e7..7def2696a 100644
--- a/web/frontend/src/pages/form/components/ActionButtons/InitializeButton.tsx
+++ b/web/frontend/src/pages/form/components/ActionButtons/InitializeButton.tsx
@@ -4,14 +4,14 @@ import { useContext } from 'react';
 import { useTranslation } from 'react-i18next';
 import { OngoingAction, Status } from 'types/form';
 import ActionButton from './ActionButton';
-const SUBJECT_ELECTION = 'election';
-const ACTION_CREATE = 'create';
-const InitializeButton = ({ status, handleInitialize, ongoingAction }) => {
-  const authCtx = useContext(AuthContext);
+import { isManager } from './utils';
+
+const InitializeButton = ({ status, handleInitialize, ongoingAction, formID }) => {
+  const { authorization, isLogged } = useContext(AuthContext);
   const { t } = useTranslation();
 
   return (
-    authCtx.isAllowed(SUBJECT_ELECTION, ACTION_CREATE) &&
+    isManager(formID, authorization, isLogged) &&
     status === Status.Initial && (
       <ActionButton
         handleClick={handleInitialize}
diff --git a/web/frontend/src/pages/form/components/utils/useChangeAction.tsx b/web/frontend/src/pages/form/components/utils/useChangeAction.tsx
index 6fb4e9a6c..74f55fb3c 100644
--- a/web/frontend/src/pages/form/components/utils/useChangeAction.tsx
+++ b/web/frontend/src/pages/form/components/utils/useChangeAction.tsx
@@ -488,6 +488,7 @@ const useChangeAction = (
               status={status}
               handleInitialize={handleInitialize}
               ongoingAction={ongoingAction}
+              formID={formID}
             />
             <DeleteButton handleDelete={handleDelete} formID={formID} />
           </>
diff --git a/web/frontend/tests/forms.spec.ts b/web/frontend/tests/forms.spec.ts
index 0fbe2fffd..a2920aa59 100644
--- a/web/frontend/tests/forms.spec.ts
+++ b/web/frontend/tests/forms.spec.ts
@@ -76,6 +76,16 @@ test('Assert "Add voters" button is only visible to owner', async ({ page }) =>
   await assertIsOnlyVisibleToOwnerStates(page, page.getByTestId('addVotersButton'), [0, 1]);
 });
 
+test('Assert "Initialize" button is only visible to owner', async ({ page }) => {
+  await assertIsOnlyVisibleToOwnerStates(
+    page,
+    page.getByRole('button', { name: i18n.t('initialize') }),
+    [0],
+    0,
+    false
+  );
+});
+
 test('Assert "Setup" button is only visible to owner', async ({ page }) => {
   await assertIsOnlyVisibleToOwnerStates(
     page,