Do not show emails to event owners

app/Event.php

@@ -57,6 +57,9 @@ class Event extends Model
         Event::class => EventPolicy::class,
     ];
 
+    public function getJavascriptData(){
+        return $this->only(["geoposition","title","description"]);
+    }
 
     public function getDescriptionForEvent(string $eventName): string
     {

resources/views/event/show.blade.php

@@ -21,7 +21,7 @@
                     <strong>@lang('eventdetails.organised_by')</strong>
 
                     <p> {{ $event->organizer }}
-                        @can('edit', $event)
+                        @can('approve', $event)
                             <br/><a href="mailto:{{$event->user_email}}">{{$event->user_email}}</a>
                         @endcan
                     </p>
@@ -188,7 +188,7 @@
     <script>
 
 
-        var event = {!! json_encode($event) !!};
+        var event = {!! json_encode($event->getJavascriptData()) !!};
 
         var geoposition = event.geoposition;
         var coordinates = geoposition.split(",");

tests/Feature/EventsTest.php

@@ -18,6 +18,7 @@ class EventsTest extends TestCase
     public function setup()
     {
         parent::setUp();
+        $this->seed('RolesAndPermissionsSeeder');
         $this->event = create('App\Event', ["country_iso" => create('App\Country')->iso, "status"=>"APPROVED"]);
 
         $this->event->audiences()->saveMany(factory('App\Audience', 3)->make());
@@ -84,5 +85,58 @@ public function a_user_can_see_tags_associated_with_events()
 
     }
 
+    /** @test */
+    public function visitors_cant_see_the_user_email()
+    {
+
+        $event = create('App\Event', ["user_email"=>"foo@bar.com","country_iso" => create('App\Country')->iso, "status"=>"APPROVED"]);
+
+        $this->get('/view/' . $event->id . '/random')
+            ->assertDontSee('foo@bar.com');
+
+    }
+
+    /** @test */
+    public function ambassadors_from_other_countries_cant_see_the_user_email()
+    {
+
+        $ambassador = create('App\User', ['country_iso' => 'FR'])->assignRole('ambassador');
+        $this->signIn($ambassador);
+
+        $event = create('App\Event', ["user_email"=>"foo@bar.com","country_iso" => "BE", "status"=>"APPROVED"]);
+
+        $this->get('/view/' . $event->id . '/random')
+            ->assertDontSee('foo@bar.com');
+
+    }
+
+    /** @test */
+    public function ambassadors_from_same_country_can_see_the_user_email()
+    {
+
+        $ambassador = create('App\User', ['country_iso' => 'FR'])->assignRole('ambassador');
+        $this->signIn($ambassador);
+
+        $event = create('App\Event', ["user_email"=>"foo@bar.com","country_iso" => "FR", "status"=>"APPROVED"]);
+
+        $this->get('/view/' . $event->id . '/random')
+            ->assertSee('foo@bar.com');
+
+    }
+
+    /** @test */
+    public function admins_can_see_the_user_email()
+    {
+
+        $admin = create('App\User')->assignRole('super admin');
+        $this->signIn($admin);
+
+        $event = create('App\Event', ["user_email"=>"foo@bar.com", "status"=>"APPROVED"]);
+
+        $this->get('/view/' . $event->id . '/random')
+            ->assertSee('foo@bar.com');
+
+    }
+
 
 }