only show MT-button if user has publish rights for a page

integreat_cms/cms/forms/pages/page_translation_form.py

@@ -1,8 +1,12 @@
 from __future__ import annotations
 
 import logging
+from typing import TYPE_CHECKING
 
-from ...models import PageTranslation
+if TYPE_CHECKING:
+    from treebeard.ns_tree import NS_NodeQuerySet
+
+from ...models import LanguageTreeNode, PageTranslation
 from ..machine_translation_form import MachineTranslationForm
 
 logger = logging.getLogger(__name__)
@@ -13,6 +17,22 @@ class PageTranslationForm(MachineTranslationForm):
     Form for creating and modifying page translation objects
     """
 
+    def user_has_publish_rights(self) -> bool:
+        """
+        Helper method to check if the current user has permission to publish the page
+        """
+        if page_obj := self.instance.page:
+            return self.request.user.has_perm("cms.publish_page_object", page_obj)
+        return self.request.user.has_perm("cms.publish_page")
+
+    def mt_form_is_enabled(self) -> NS_NodeQuerySet:
+        """
+        For pages, machine translations should only be enabled if the user has publishing rights
+        """
+        if not self.user_has_publish_rights():
+            return LanguageTreeNode.objects.none()
+        return super().mt_form_is_enabled()
+
     class Meta:
         """
         This class contains additional meta configuration of the form class, see the :class:`django.forms.ModelForm`

tests/mt_api/test_mt_button_visibility.py

@@ -0,0 +1,47 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+if TYPE_CHECKING:
+    from django.test.client import Client
+
+import re
+
+import pytest
+from django.apps import apps
+from django.urls import reverse
+
+from ..conftest import EDITOR, MANAGEMENT, PRIV_STAFF_ROLES
+
+
+@pytest.mark.django_db
+def test_mt_button_visibility(
+    load_test_data: None,
+    login_role_user: tuple[Client, str],
+) -> None:
+    """
+    Check that MT button is invisible for users without publishing rights
+    :param load_test_data: The fixture providing the test data (see :meth:`~tests.conftest.load_test_data`)
+    :param login_role_user: The fixture providing the http client and the current role (see :meth:`~tests.conftest.login_role_user`)
+    """
+    apps.get_app_config("deepl_api").supported_source_languages = "de"
+    apps.get_app_config("deepl_api").supported_target_languages = "en"
+
+    client, role = login_role_user
+    page = reverse(
+        "edit_page",
+        kwargs={"region_slug": "augsburg", "language_slug": "de", "page_id": 4},
+    )
+    data = {
+        "title": "Neuer Titel",
+        "content": "Neuer Inhalt",
+        "mirrored_page_region": "",
+    }
+
+    response = client.post(page, data=data)
+    pattern = r'<input[^>]*id="id_automatic_translation"[^>]*>'
+    match = re.search(pattern, response.content.decode())
+    if role in [*PRIV_STAFF_ROLES, EDITOR, MANAGEMENT]:
+        assert match is not None, f"MT button should be visible for role {role}"
+    else:
+        assert match is None, f"MT button should not be visible for role {role}"