Fix: Edit/deleting tasks in a challenge appears possible for people who are not admin/the creator (#11349)

* Fix: introduce new prop showOptions for task component

- Pull showOptions propr from challenge container to task itself to restrict editing for non leader of challenge users

* Fix: for group plan edit/delete tasks

website/client/components/challenges/challengeDetail.vue

@@ -57,6 +57,7 @@
         :type="column",
         :key="column",
         :taskListOverride='tasksByType[column]',
+        :showOptions="showOptions",
         @editTask="editTask",
         @taskDestroyed="taskDestroyed",
         v-if='tasksByType[column].length > 0')
@@ -251,6 +252,9 @@ export default {
     canJoin () {
       return !this.isMember;
     },
+    showOptions () {
+      return this.isLeader;
+    },
   },
   mounted () {
     if (!this.searchId) this.searchId = this.challengeId;

website/client/components/group-plans/taskInformation.vue

@@ -41,6 +41,7 @@
       :type="column",
       :key="column",
       :taskListOverride='tasksByType[column]',
+      :showOptions="showOptions"
       v-on:editTask="editTask",
       v-on:loadGroupCompletedTodos="loadGroupCompletedTodos",
       v-on:taskDestroyed="taskDestroyed",
@@ -176,6 +177,9 @@ export default {
       if (!this.group) return false;
       return this.group.leader && this.group.leader._id === this.user._id || this.group.managers && Boolean(this.group.managers[this.user._id]);
     },
+    showOptions () {
+      return this.canCreateTasks;
+    },
   },
   methods: {
     async load () {

website/client/components/tasks/column.vue

@@ -45,6 +45,7 @@
         v-for="task in taskList",
         :key="task.id", :task="task",
         :isUser="isUser",
+        :showOptions="showOptions"
         @editTask="editTask",
         @moveTo="moveTo",
         :group='group',
@@ -311,6 +312,10 @@ export default {
     selectedTags: {},
     taskListOverride: {},
     group: {},
+    showOptions: {
+      type: Boolean,
+      default: true,
+    },
   }, // @TODO: maybe we should store the group on state?
   data () {
     const icons = Object.freeze({

website/client/components/tasks/task.vue

@@ -19,7 +19,7 @@
           .d-flex.justify-content-between
             h3.task-title(:class="{ 'has-notes': task.notes }", v-markdown="task.text")
             menu-dropdown.task-dropdown(
-              v-if="!isRunningYesterdailies",
+              v-if="!isRunningYesterdailies && showOptions",
               :right="task.type === 'reward'",
               ref="taskDropdown",
               v-b-tooltip.hover.top="$t('options')"
@@ -555,7 +555,7 @@ export default {
   directives: {
     markdown: markdownDirective,
   },
-  props: ['task', 'isUser', 'group', 'dueDate'], // @TODO: maybe we should store the group on state?
+  props: ['task', 'isUser', 'group', 'dueDate', 'showOptions'], // @TODO: maybe we should store the group on state?
   data () {
     return {
       random: uuid.v4(), // used to avoid conflicts between checkboxes ids