fix(project): hide mentor-only controls

src/main/java/com/lab/labtimesheet/feature/project/controller/ProjectController.java

@@ -1,5 +1,6 @@
 package com.lab.labtimesheet.feature.project.controller;
 
+import com.lab.labtimesheet.feature.project.exception.ProjectAccessDeniedException;
 import com.lab.labtimesheet.feature.project.model.dto.ProjectCreateForm;
 import com.lab.labtimesheet.feature.project.model.dto.ProjectMemberForm;
 import com.lab.labtimesheet.feature.project.service.ProjectQueryService;
@@ -34,7 +35,10 @@ public class ProjectController {
     }
 
     @GetMapping("/new")
-    public String createForm(Model model) {
+    public String createForm(Principal principal, Model model) {
+        if (!"MENTOR".equals(pages.authenticatedActor(principal.getName()).role())) {
+            throw new ProjectAccessDeniedException();
+        }
         model.addAttribute("projectForm", new ProjectCreateForm());
         return "projects/form";
     }

src/main/java/com/lab/labtimesheet/feature/project/model/dto/ProjectDetail.java

@@ -10,5 +10,6 @@ public record ProjectDetail(
         LocalDate startDate,
         LocalDate endDate,
         String mentorName,
-        String leaderName) {
+        String leaderName,
+        boolean canManage) {
 }

src/main/java/com/lab/labtimesheet/feature/project/service/ProjectQueryService.java

@@ -64,7 +64,8 @@ public class ProjectQueryService {
                 project.startDate(),
                 project.endDate(),
                 displayName(project.mentorUserId()),
-                displayName(project.currentLeader().internUserId()));
+                displayName(project.currentLeader().internUserId()),
+                project.mentorUserId() == actorUserId);
     }
 
     @Transactional(readOnly = true)

src/main/resources/templates/projects/leadership.html

@@ -7,7 +7,7 @@
   <table><caption>Leadership history</caption><thead><tr><th scope="col">Leader</th><th scope="col">Started</th><th scope="col">Ended</th></tr></thead>
     <tbody><tr th:each="term : ${leadership}"><td th:text="${term.leaderName}"></td><td th:text="${term.startedAt}"></td><td th:text="${term.endedAt}"></td></tr></tbody>
   </table>
-  <form method="post" th:action="@{/projects/{id}/leadership(id=${project.id})}"><label for="leader">New Leader user ID</label><input id="leader" name="internUserId" type="number" min="1" required><button type="submit">Change Leader</button></form>
+  <form th:if="${project.canManage}" method="post" th:action="@{/projects/{id}/leadership(id=${project.id})}"><label for="leader">New Leader user ID</label><input id="leader" name="internUserId" type="number" min="1" required><button type="submit">Change Leader</button></form>
 </main>
 </body>
 </html>

src/main/resources/templates/projects/members.html

@@ -7,7 +7,7 @@
   <table><caption>Membership history</caption><thead><tr><th scope="col">Intern</th><th scope="col">Joined</th><th scope="col">Left</th><th scope="col">Role</th></tr></thead>
     <tbody><tr th:each="member : ${members}"><td th:text="${member.displayName}"></td><td th:text="${member.joinedAt}"></td><td th:text="${member.leftAt}"></td><td th:text="${member.currentLeader} ? 'Leader' : 'Member'"></td></tr></tbody>
   </table>
-  <form method="post" th:action="@{/projects/{id}/members(id=${project.id})}"><label for="intern">Intern user ID</label><input id="intern" name="internUserId" type="number" min="1" required><button type="submit">Add member</button></form>
+  <form th:if="${project.canManage}" method="post" th:action="@{/projects/{id}/members(id=${project.id})}"><label for="intern">Intern user ID</label><input id="intern" name="internUserId" type="number" min="1" required><button type="submit">Add member</button></form>
 </main>
 </body>
 </html>