From da0bfd8b476ff2064a17641244fb2e98c486c017 Mon Sep 17 00:00:00 2001
From: Andrew Kingston <aptkingston@ssl-mail.com>
Date: Wed, 19 May 2021 18:46:15 +0100
Subject: [PATCH] Prevent creating, deleting or editing global fields for user
 in the backend UI of the builder

---
 .../src/components/backend/DataTable/DataTable.svelte  | 10 ++++++----
 .../src/components/backend/DataTable/Table.svelte      |  4 ++--
 .../backend/DataTable/modals/CreateEditUser.svelte     |  4 +++-
 packages/builder/src/constants/index.js                |  9 ++++++++-
 4 files changed, 19 insertions(+), 8 deletions(-)

diff --git a/packages/builder/src/components/backend/DataTable/DataTable.svelte b/packages/builder/src/components/backend/DataTable/DataTable.svelte
index 3697adb7ac..a030adfcf6 100644
--- a/packages/builder/src/components/backend/DataTable/DataTable.svelte
+++ b/packages/builder/src/components/backend/DataTable/DataTable.svelte
@@ -57,10 +57,12 @@
 >
   <CreateColumnButton />
   {#if schema && Object.keys(schema).length > 0}
-    <CreateRowButton
-      title={isUsersTable ? "Create user" : "Create row"}
-      modalContentComponent={isUsersTable ? CreateEditUser : CreateEditRow}
-    />
+    {#if !isUsersTable}
+      <CreateRowButton
+        title={"Create row"}
+        modalContentComponent={CreateEditRow}
+      />
+    {/if}
     <CreateViewButton />
     <ManageAccessButton resourceId={$tables.selected?._id} />
     {#if isUsersTable}
diff --git a/packages/builder/src/components/backend/DataTable/Table.svelte b/packages/builder/src/components/backend/DataTable/Table.svelte
index 40a5d1dbac..c23a6e3107 100644
--- a/packages/builder/src/components/backend/DataTable/Table.svelte
+++ b/packages/builder/src/components/backend/DataTable/Table.svelte
@@ -103,7 +103,7 @@
   </div>
   <div class="popovers">
     <slot />
-    {#if selectedRows.length > 0}
+    {#if !isUsersTable && selectedRows.length > 0}
       <DeleteRowsButton {selectedRows} {deleteRows} />
     {/if}
   </div>
@@ -116,7 +116,7 @@
     {customRenderers}
     {rowCount}
     bind:selectedRows
-    allowSelectRows={allowEditing}
+    allowSelectRows={allowEditing && !isUsersTable}
     allowEditRows={allowEditing}
     allowEditColumns={allowEditing}
     showAutoColumns={!hideAutocolumns}
diff --git a/packages/builder/src/components/backend/DataTable/modals/CreateEditUser.svelte b/packages/builder/src/components/backend/DataTable/modals/CreateEditUser.svelte
index b18e26fde4..62985d4285 100644
--- a/packages/builder/src/components/backend/DataTable/modals/CreateEditUser.svelte
+++ b/packages/builder/src/components/backend/DataTable/modals/CreateEditUser.svelte
@@ -69,7 +69,7 @@
       return false
     }
 
-    notifications.success("User saved successfully.")
+    notifications.success("User saved successfully")
     rows.save(rowResponse)
   }
 </script>
@@ -88,10 +88,12 @@
   <RowFieldControl
     meta={{ ...tableSchema.firstName, name: "First Name" }}
     bind:value={row.firstName}
+    readonly={!creating}
   />
   <RowFieldControl
     meta={{ ...tableSchema.lastName, name: "Last Name" }}
     bind:value={row.lastName}
+    readonly={!creating}
   />
   <!-- Defer rendering this select until roles load, otherwise the initial
        selection is always undefined -->
diff --git a/packages/builder/src/constants/index.js b/packages/builder/src/constants/index.js
index 4d2f700ee7..aa1ccd729b 100644
--- a/packages/builder/src/constants/index.js
+++ b/packages/builder/src/constants/index.js
@@ -15,7 +15,14 @@ export const AppStatus = {
 }
 
 // fields on the user table that cannot be edited
-export const UNEDITABLE_USER_FIELDS = ["email", "password", "roleId", "status"]
+export const UNEDITABLE_USER_FIELDS = [
+  "email",
+  "password",
+  "roleId",
+  "status",
+  "firstName",
+  "lastName",
+]
 
 export const LAYOUT_NAMES = {
   MASTER: {