From 7b87e65bf52ab42e5c3a97a3753a4c1ba370d882 Mon Sep 17 00:00:00 2001
From: Hermann Pauly <hp@campudus.com>
Date: Tue, 16 Jan 2024 15:37:59 +0100
Subject: [PATCH] Add settings table keys check to `canUserChangeCell`

---
 src/app/helpers/accessManagementHelper.js | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/src/app/helpers/accessManagementHelper.js b/src/app/helpers/accessManagementHelper.js
index cbcd24ef8..dac05528f 100644
--- a/src/app/helpers/accessManagementHelper.js
+++ b/src/app/helpers/accessManagementHelper.js
@@ -1,6 +1,10 @@
 import f from "lodash/fp";
 
-import { Langtags, ImmutableColumnKinds } from "../constants/TableauxConstants";
+import {
+  Langtags,
+  ImmutableColumnKinds,
+  TableType
+} from "../constants/TableauxConstants";
 import { memoizeWith, unless } from "./functools";
 import { noAuthNeeded } from "./authenticate";
 import store from "../redux/store";
@@ -63,6 +67,11 @@ const getPermission = pathToPermission =>
     lookUpPermissions
   );
 
+const isSettingsTable = table => table.type === TableType.settings;
+const isSettingsKey = cell =>
+  isSettingsTable(cell.table) &&
+  (cell.column.name === "key" || cell.column.name === "displayKey");
+
 // (cell | {tableId: number, columnId: number}) -> (langtag | nil) -> boolean
 export const canUserChangeCell = f.curry((cellInfo, langtag) => {
   const { kind } = cellInfo;
@@ -72,7 +81,11 @@ export const canUserChangeCell = f.curry((cellInfo, langtag) => {
     ? editCellValue
     : f.isPlainObject(editCellValue) && editCellValue[langtag];
 
-  return !f.contains(kind, ImmutableColumnKinds) && (allowed || noAuthNeeded()); // this special case is not caught by ALLOW_ANYTHING
+  return (
+    !isSettingsKey(cellInfo) &&
+    !f.contains(kind, ImmutableColumnKinds) &&
+    (allowed || noAuthNeeded())
+  ); // this special case is not caught by ALLOW_ANYTHING
 });
 
 export const canUserChangeAnyCountryTypeCell = cellInfo => {