don't show 'delegate' action for non-privileged users

git-svn-id: svn://svn.cy55.de/Zope3/src/loops/trunk@4190 fd906abe-77d9-0310-91a1-e0d9ade77398

organize/work/README.txt

@@ -136,10 +136,13 @@ work item, the form will be pre-filled with some of the item's data.
   >>> form.title
   u'Install Zope'
 
+The 'delegate' transition is omitted from the actions list because it is
+only available for privileged users.
+
   >>> form.actions
   [{'name': 'plan', 'title': 'plan'}, {'name': 'accept', 'title': 'accept'},
    {'name': 'start', 'title': 'start working'}, {'name': 'work', 'title': 'work'},
-   {'name': 'finish', 'title': 'finish'}, {'name': 'delegate', 'title': 'delegate'},
+   {'name': 'finish', 'title': 'finish'},
    {'name': 'cancel', 'title': 'cancel'}, {'name': 'modify', 'title': 'modify'}]
 
 

organize/work/browser.py

@@ -48,6 +48,7 @@ from loops.organize.tracking.browser import BaseTrackView
 from loops.organize.tracking.report import TrackDetails
 from loops.organize.work.base import WorkItem
 from loops.security.common import canAccessObject, canListObject, canWriteObject
+from loops.security.common import checkPermission
 from loops import util
 from loops.util import _
 
@@ -333,8 +334,11 @@ class CreateWorkItemForm(ObjectForm, BaseTrackView):
 
     @Lazy
     def actions(self):
-        return [dict(name=t.name, title=t.title)
-                    for t in self.track.getAvailableTransitions()]
+        result = [dict(name=t.name, title=t.title)
+                    for t in self.track.getAvailableTransitions()
+                    if t.name != 'delegate' or
+                        checkPermission('loops.ManageSite', self.context)]
+        return result
 
     @Lazy
     def candidates(self):