Merge pull request #114 from teamsnap/manager-owner-permissions

Prevent manager from editing owner member item

Author: matthopson

CHANGELOG.md

@@ -1,5 +1,10 @@
 # TeamSnap JavaScript SDK CHANGELOG
 
+### Feb 4, 2016 // Version 1.8.1
+- Update `canEditItem()` helper to return false when a manager attempts to edit an owner's member item.
+
+---
+
 ### Feb 4, 2016 // Version 1.8.0
 - Adds `bulkCreateEvents` method.
 

lib/teamsnap.js

@@ -1738,6 +1738,9 @@ exports.canEditItem = function(member, team, item) {
   if (item.readOnly) {
     return false;
   }
+  if (item.type === 'member' && item.isOwner && !member.isOwner) {
+    return false;
+  }
   if (teamsnap.canEditTeam(member, team)) {
     return true;
   }
@@ -5766,7 +5769,7 @@ ref = require('./model'), Collection = ref.Collection, Item = ref.Item;
 require('./errors');
 
 TeamSnap = (function() {
-  TeamSnap.prototype.version = '1.8.0';
+  TeamSnap.prototype.version = '1.8.1';
 
   TeamSnap.prototype.promises = promises;
 

lib/teamsnap.min.js

@@ -1,6 +1,6 @@
 {
   "name": "teamsnap.js",
-  "version": "1.8.0",
+  "version": "1.8.1",
   "description": "A JavaScript library for using the TeamSnap API.",
   "author": "Jacob Wright with TeamSnap (http://www.teamsnap.com)",
   "homepage": "https://github.com/teamsnap/teamsnap-javascript-sdk",

package.json

@@ -138,6 +138,7 @@ exports.canEditTeam = (member, team) ->
 exports.canEditItem = (member, team, item) ->
   return false unless member and team and @isItem item
   return false if item.readOnly
+  return false if item.type is 'member' and item.isOwner and not member.isOwner
   return true if teamsnap.canEditTeam member, team
   return false if team.isArchivedSeason
   if @isItem item, 'member'

src/collections/members.coffee

@@ -3,7 +3,7 @@ promises = require './promises'
 require './errors'
 
 class TeamSnap
-  version: '1.8.0'
+  version: '1.8.1'
   promises: promises
   when: promises.when
   TeamSnap: TeamSnap