order status not changable for normal users

ordr2/schemas/account.py

@@ -131,10 +131,6 @@ class SettingsSchema(CSRFSchema):
         settings.update(override)
         form = super().as_form(request, **settings)
         # disable the role field for user settings
-        form['general']['role'].widget = deform.widget.SelectWidget(
-            values=ROLES,
-            template='select_disabled.pt'
-            )
         form['general']['role'].widget = deform.widget.TextInputWidget(
             template='textinput_disabled.pt'
             )

ordr2/schemas/orders.py

@@ -177,4 +177,10 @@ class EditOrderSchema(CSRFSchema):
             'css_class': 'form-horizontal'
             }
         settings.update(override)
-        return super().as_form(request, **settings)
+        form = super().as_form(request, **settings)
+        if not 'role:purchaser' in request.user.role_principals:
+            form['order_information']['status'].widget = \
+                deform.widget.TextInputWidget(
+                    template='textinput_disabled.pt'
+                )
+        return form

ordr2/static/css/style.css

@@ -463,6 +463,17 @@ table .action.edit:hover {
 	background-position: -16px -52px;
 }
 
+table .action.eye {
+	background-position: -145px 0px;
+}
+
+table .action.eye:hover {
+	background-position: -145px -18px;
+}
+
+
+
+
 /*================================ MODALS ================================*/
 
 .modal form {

ordr2/templates/orders/list.jinja2

@@ -96,7 +96,7 @@
                                             {% if request.has_permission('edit', order) %}
                                                 <a href="{{ request.resource_url(order, 'edit') }}" class="action edit" title="Edit Order">edit</a>
                                             {% else %}
-                                                <a href="{{ request.resource_url(order) }}" class="action edit" title="Edit Order">edit</a>
+                                                <a href="{{ request.resource_url(order) }}" class="action eye" title="View Order">edit</a>
                                             {% endif %}
                                             {% if request.has_permission('delete', order) %}
                                                 <a href="{{ request.resource_url(order, 'delete') }}" class="action delete" title="Delete Order">delete</a>