Make team members list operations access-aware (#433)

apigee · Aug 5, 2020 · 453354d · 453354d
1 parent 94e52be
commit 453354d
Showing 1 changed file with 16 additions and 8 deletions.
diff --git a/modules/apigee_edge_teams/src/Controller/TeamMembersList.php b/modules/apigee_edge_teams/src/Controller/TeamMembersList.php
@@ -228,14 +228,22 @@ protected function buildOperations(string $member, TeamInterface $team): array {
    */
   protected function getOperations(string $member, TeamInterface $team) {
     $operations = [];
-    $operations['edit'] = [
-      'title' => $this->t('Edit'),
-      'url' => Url::fromRoute('entity.team.member.edit', ['team' => $team->id(), 'developer' => $member], ['query' => ['destination' => $team->toUrl('members')->toString()]]),
-    ];
-    $operations['remove'] = [
-      'title' => $this->t('Remove'),
-      'url' => Url::fromRoute('entity.team.member.remove', ['team' => $team->id(), 'developer' => $member], ['query' => ['destination' => $team->toUrl('members')->toString()]]),
-    ];
+
+    $url = Url::fromRoute('entity.team.member.edit', ['team' => $team->id(), 'developer' => $member], ['query' => ['destination' => $team->toUrl('members')->toString()]]);
+    if ($url->access()) {
+      $operations['edit'] = [
+        'title' => $this->t('Edit'),
+        'url' => $url,
+      ];
+    }
+
+    $url = Url::fromRoute('entity.team.member.remove', ['team' => $team->id(), 'developer' => $member], ['query' => ['destination' => $team->toUrl('members')->toString()]]);
+    if ($url->access()) {
+      $operations['remove'] = [
+        'title' => $this->t('Remove'),
+        'url' => $url,
+      ];
+    }
 
     return $operations;
   }