From 973dbf04828c1b5f475c189d12dd8c099ac8b35e Mon Sep 17 00:00:00 2001
From: Kevin Morris <kevr@0cost.org>
Date: Sat, 4 Dec 2021 00:15:34 -0800
Subject: [PATCH] fix(python): use creds to determine account links to display

Signed-off-by: Kevin Morris <kevr@0cost.org>
---
 templates/account/show.html | 32 ++++++++++++++++++--------------
 1 file changed, 18 insertions(+), 14 deletions(-)

diff --git a/templates/account/show.html b/templates/account/show.html
index 0c99c99f..14a4eccf 100644
--- a/templates/account/show.html
+++ b/templates/account/show.html
@@ -69,20 +69,24 @@
                                                     | safe
                                                     }}
                                                 </li>
-                                                <li>
-                                                    {{ "%sEdit this user's account%s"
-                                                    | tr
-                                                    | format('<a href="/account/%s/edit">' | format(user.Username), "</a>")
-                                                    | safe
-                                                    }}
-                                                </li>
-                                                <li>
-                                                    {{ "%sList this user's comments%s"
-                                                    | tr
-                                                    | format('<a href="/account/%s/comments">' | format(user.Username), "</a>")
-                                                    | safe
-                                                    }}
-                                                </li>
+                                                {% if request.user.has_credential(creds.ACCOUNT_EDIT, approved=[user]) %}
+                                                    <li>
+                                                        {{ "%sEdit this user's account%s"
+                                                        | tr
+                                                        | format('<a href="/account/%s/edit">' | format(user.Username), "</a>")
+                                                        | safe
+                                                        }}
+                                                    </li>
+                                                {% endif %}
+                                                {% if request.user.has_credential(creds.ACCOUNT_LIST_COMMENTS, approved=[user]) %}
+                                                    <li>
+                                                        {{ "%sList this user's comments%s"
+                                                        | tr
+                                                        | format('<a href="/account/%s/comments">' | format(user.Username), "</a>")
+                                                        | safe
+                                                        }}
+                                                    </li>
+                                                {% endif %}
                                             </ul>
                                         </td>
                                     </tr>