permission, gemfile.lock for github_api

plugins/workflow_report/Gemfile.lock

+GEM
+  specs:
+    addressable (2.5.2)
+      public_suffix (>= 2.0.2, < 4.0)
+    descendants_tracker (0.0.4)
+      thread_safe (~> 0.3, >= 0.3.1)
+    faraday (1.0.1)
+      multipart-post (>= 1.2, < 3)
+    github_api (0.19.0)
+      addressable (~> 2.4)
+      descendants_tracker (~> 0.0.4)
+      faraday (>= 0.8, < 2)
+      hashie (~> 3.5, >= 3.5.2)
+      oauth2 (~> 1.0)
+    hashie (3.6.0)
+    jwt (2.3.0)
+    multi_json (1.13.0)
+    multi_xml (0.6.0)
+    multipart-post (2.3.0)
+    oauth2 (1.4.11)
+      faraday (>= 0.17.3, < 3.0)
+      jwt (>= 1.0, < 3.0)
+      multi_json (~> 1.3)
+      multi_xml (~> 0.5)
+      rack (>= 1.2, < 4)
+    public_suffix (3.0.1)
+    rack (1.6.8)
+    thread_safe (0.3.6)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  github_api (~> 0.19.0)
+
+BUNDLED WITH
+   1.17.3

plugins/workflow_report/app/controllers/workflow_report_controller.rb

 require 'csv'
 
 class WorkflowReportController < ApplicationController
+  before_action :authorize_global
+  before_action :require_xhr_request, only: :export
 
   def index
     @team_options = $workflow_report_config['teams'].map { |team| team.keys() }
@@ -239,4 +241,8 @@ class WorkflowReportController < ApplicationController
     end
     name.strip
   end
+
+  def require_xhr_request
+    head :unprocessable_entity unless request.xhr?
+  end
 end

plugins/workflow_report/app/views/workflow_report/index.html.slim

@@ -5,8 +5,14 @@ fieldset.box.tabular
   legend
     | EXPORT WORKFLOW
   = form_tag do
+    p
+      = label :month, 'Month'
       = select_tag :month  ,options_for_select(1..12, Time.now.month),{ prompt: "Select month" }
+    p
+      = label :year, 'Year'
       = select_tag :year  ,options_for_select((Time.now.year - 5)..(Time.now.year + 1), Time.now.year),{ prompt: "Select year" }
+    p
+      = label :team, 'Team'
       = select_tag :team, options_for_select(@team_options), { prompt: "Select team" }
     = submit_tag 'export', id: 'export'
 button.export-button.d-none Download .CSV

plugins/workflow_report/assets/stylesheets/style.css

@@ -54,10 +54,6 @@ table {
     background-color: pink;
 }
 
-#year, #month, #team, #export {
-    margin: 8px 24px 0 0;
-}
-
 button.export-button {
     margin-bottom: 35px;
 }

plugins/workflow_report/config/routes.rb

@@ -3,4 +3,3 @@
 
 get 'workflow_report', to: 'workflow_report#index'
 get 'workflow_report/export', to: 'workflow_report#export'
-get '/download_csv', to: 'workflow_report#export_csv'

plugins/workflow_report/init.rb

@@ -13,5 +13,21 @@ Redmine::Plugin.register :workflow_report do
   author_url 'http://example.com/about'
   configfile = File.join(File.dirname(__FILE__), 'config', 'settings.yml')
   $workflow_report_config = YAML::load_file(configfile)
-  menu :top_menu, :workflow_report, { controller: 'workflow_report', action: 'index' }, caption: 'Workflow Report'
 end
+
+Redmine::MenuManager.map :top_menu do |menu|
+  menu.push(:workflow_report, { controller: 'workflow_report', action: 'index' },
+            caption: 'Workflow Report',
+            if: proc { User.current.allowed_to_globally?(:view_workflow_report) })
+end
+
+ActionDispatch::Reloader.to_prepare do
+  Redmine::AccessControl.map do |map|
+    map.project_module :workflow_report do |pmap|
+      pmap.permission(:view_workflow_report, {
+        workflow_report: [:index, :export],
+      }, read: true)
+    end
+  end
+end
+