From 566089f18ce2fd6b231ba0103a61677f03c07dc4 Mon Sep 17 00:00:00 2001
From: Alain Van Driessche <alainvd@gmail.com>
Date: Mon, 29 Oct 2018 17:19:19 +0100
Subject: [PATCH] Do not show emails to event owners

---
 app/Event.php                        |  3 ++
 resources/views/event/show.blade.php |  4 +--
 tests/Feature/EventsTest.php         | 54 ++++++++++++++++++++++++++++
 3 files changed, 59 insertions(+), 2 deletions(-)

diff --git a/app/Event.php b/app/Event.php
index 7d2edf855..1ba21c9ef 100644
--- a/app/Event.php
+++ b/app/Event.php
@@ -57,6 +57,9 @@ class Event extends Model
         Event::class => EventPolicy::class,
     ];
 
+    public function getJavascriptData(){
+        return $this->only(["geoposition","title","description"]);
+    }
 
     public function getDescriptionForEvent(string $eventName): string
     {
diff --git a/resources/views/event/show.blade.php b/resources/views/event/show.blade.php
index e697c7f7d..cced22eb0 100755
--- a/resources/views/event/show.blade.php
+++ b/resources/views/event/show.blade.php
@@ -21,7 +21,7 @@
                     <strong>@lang('eventdetails.organised_by')</strong>
 
                     <p> {{ $event->organizer }}
-                        @can('edit', $event)
+                        @can('approve', $event)
                             <br/><a href="mailto:{{$event->user_email}}">{{$event->user_email}}</a>
                         @endcan
                     </p>
@@ -188,7 +188,7 @@
     <script>
 
 
-        var event = {!! json_encode($event) !!};
+        var event = {!! json_encode($event->getJavascriptData()) !!};
 
         var geoposition = event.geoposition;
         var coordinates = geoposition.split(",");
diff --git a/tests/Feature/EventsTest.php b/tests/Feature/EventsTest.php
index d81e834a1..f69dcc652 100755
--- a/tests/Feature/EventsTest.php
+++ b/tests/Feature/EventsTest.php
@@ -18,6 +18,7 @@ class EventsTest extends TestCase
     public function setup()
     {
         parent::setUp();
+        $this->seed('RolesAndPermissionsSeeder');
         $this->event = create('App\Event', ["country_iso" => create('App\Country')->iso, "status"=>"APPROVED"]);
 
         $this->event->audiences()->saveMany(factory('App\Audience', 3)->make());
@@ -84,5 +85,58 @@ public function a_user_can_see_tags_associated_with_events()
 
     }
 
+    /** @test */
+    public function visitors_cant_see_the_user_email()
+    {
+
+        $event = create('App\Event', ["user_email"=>"foo@bar.com","country_iso" => create('App\Country')->iso, "status"=>"APPROVED"]);
+
+        $this->get('/view/' . $event->id . '/random')
+            ->assertDontSee('foo@bar.com');
+
+    }
+
+    /** @test */
+    public function ambassadors_from_other_countries_cant_see_the_user_email()
+    {
+
+        $ambassador = create('App\User', ['country_iso' => 'FR'])->assignRole('ambassador');
+        $this->signIn($ambassador);
+
+        $event = create('App\Event', ["user_email"=>"foo@bar.com","country_iso" => "BE", "status"=>"APPROVED"]);
+
+        $this->get('/view/' . $event->id . '/random')
+            ->assertDontSee('foo@bar.com');
+
+    }
+
+    /** @test */
+    public function ambassadors_from_same_country_can_see_the_user_email()
+    {
+
+        $ambassador = create('App\User', ['country_iso' => 'FR'])->assignRole('ambassador');
+        $this->signIn($ambassador);
+
+        $event = create('App\Event', ["user_email"=>"foo@bar.com","country_iso" => "FR", "status"=>"APPROVED"]);
+
+        $this->get('/view/' . $event->id . '/random')
+            ->assertSee('foo@bar.com');
+
+    }
+
+    /** @test */
+    public function admins_can_see_the_user_email()
+    {
+
+        $admin = create('App\User')->assignRole('super admin');
+        $this->signIn($admin);
+
+        $event = create('App\Event', ["user_email"=>"foo@bar.com", "status"=>"APPROVED"]);
+
+        $this->get('/view/' . $event->id . '/random')
+            ->assertSee('foo@bar.com');
+
+    }
+
 
 }