graph editing permissions

src/c3nav/editor/api.py

@@ -206,6 +206,7 @@ class EditorViewSet(EditorViewSetMixin, ViewSet):
                 all_other_spaces = []
 
             # todo: permissions
+            if request.user_permissions.can_access_base_mapdata:
                 graphnodes = request.changeset.wrap_model('GraphNode').objects.all()
                 graphnodes = graphnodes.filter((Q(space__in=all_other_spaces)) | Q(space__pk=space.pk))
 
@@ -214,6 +215,9 @@ class EditorViewSet(EditorViewSetMixin, ViewSet):
                 graphedges = request.changeset.wrap_model('GraphEdge').objects.all()
                 graphedges = graphedges.filter(Q(from_node__in=space_graphnodes) | Q(to_node__in=space_graphnodes))
                 graphedges = graphedges.select_related('from_node', 'to_node', 'waytype')
+            else:
+                graphnodes = []
+                graphedges = []
 
             areas = space.areas.filter(Area.q_for_request(request)).prefetch_related('groups')
             for area in areas:

src/c3nav/editor/views/edit.py

@@ -111,7 +111,7 @@ def space_detail(request, level, pk):
         'level': space.level,
         'level_url': 'editor.spaces.list',
         'space': space,
-        'can_edit_graph': edit_utils.can_access_child_base_mapdata,
+        'can_edit_graph': request.user_permissions.can_access_base_mapdata,
 
         'child_models': [child_model(request, model_name, kwargs={'space': pk}, parent=space)
                          for model_name in submodels],