MAGETWO-86480: Restricted admin user can remove product from other websites

Author: zakdma

app/code/Magento/Catalog/Test/Mftf/Section/ProductInWebsitesSection.xml

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ /**
+  * Copyright © Magento, Inc. All rights reserved.
+  * See COPYING.txt for license details.
+  */
+-->
+
+<sections xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+          xsi:noNamespaceSchemaLocation="../../../../../../../dev/tests/acceptance/vendor/magento/magento2-functional-testing-framework/src/Magento/FunctionalTestingFramework/Page/etc/SectionObject.xsd">
+    <section name="ProductInWebsitesSection">
+        <element name="sectionHeader" type="button" selector="div[data-index='websites']"/>
+        <element name="website" type="checkbox" selector="//label[contains(text(), '{{var1}}')]/parent::div//input[@type='checkbox']" parameterized="true"/>
+        <element name="isWebsiteDisabled" type="checkbox" selector="//label[contains(text(), '{{websiteName}}')]/parent::div//input[@type='checkbox' and @disabled]" parameterized="true"/>
+    </section>
+</sections>

app/code/Magento/Catalog/Test/Unit/Ui/DataProvider/Product/Form/Modifier/AbstractModifierTest.php

@@ -63,7 +63,8 @@ protected function setUp()
                 'getAttributes',
                 'getStore',
                 'getAttributeDefaultValue',
-                'getExistsStoreValueFlag'
+                'getExistsStoreValueFlag',
+                'isLockedAttribute'
             ])->getMockForAbstractClass();
         $this->storeMock = $this->getMockBuilder(StoreInterface::class)
             ->setMethods(['load', 'getId', 'getConfig'])
@@ -81,9 +82,6 @@ protected function setUp()
         $this->arrayManagerMock->expects($this->any())
             ->method('set')
             ->willReturnArgument(1);
-        $this->arrayManagerMock->expects($this->any())
-            ->method('merge')
-            ->willReturnArgument(1);
         $this->arrayManagerMock->expects($this->any())
             ->method('remove')
             ->willReturnArgument(1);

app/code/Magento/Catalog/Test/Unit/Ui/DataProvider/Product/Form/Modifier/AttributeSetTest.php

@@ -5,6 +5,7 @@
  */
 namespace Magento\Catalog\Test\Unit\Ui\DataProvider\Product\Form\Modifier;
 
+use Magento\Catalog\Ui\DataProvider\Product\Form\Modifier\AbstractModifier;
 use Magento\Catalog\Ui\DataProvider\Product\Form\Modifier\AttributeSet;
 use Magento\Eav\Model\ResourceModel\Entity\Attribute\Set\CollectionFactory;
 use Magento\Eav\Model\ResourceModel\Entity\Attribute\Set\Collection;
@@ -84,7 +85,31 @@ protected function createModel()
 
     public function testModifyMeta()
     {
-        $this->assertNotEmpty($this->getModel()->modifyMeta(['test_group' => []]));
+        $modifyMeta = $this->getModel()->modifyMeta(['test_group' => []]);
+        $this->assertNotEmpty($modifyMeta);
+    }
+
+    /**
+     * @param bool $locked
+     * @return void
+     * @dataProvider modifyMetaLockedDataProvider
+     */
+    public function testModifyMetaLocked($locked)
+    {
+        $this->productMock->expects($this->any())
+            ->method('isLockedAttribute')
+            ->willReturn($locked);
+        $modifyMeta = $this->getModel()->modifyMeta([AbstractModifier::DEFAULT_GENERAL_PANEL => []]);
+        $children = $modifyMeta[AbstractModifier::DEFAULT_GENERAL_PANEL]['children'];
+        $this->assertEquals(
+            $locked,
+            $children['attribute_set_id']['arguments']['data']['config']['disabled']
+        );
+    }
+
+    public function modifyMetaLockedDataProvider()
+    {
+        return [[true], [false]];
     }
 
     public function testModifyMetaToBeEmpty()

app/code/Magento/Catalog/Test/Unit/Ui/DataProvider/Product/Form/Modifier/CategoriesTest.php

@@ -114,6 +114,45 @@ public function testModifyMeta()
         $this->assertArrayHasKey($groupCode, $this->getModel()->modifyMeta($meta));
     }
 
+    /**
+     * @param bool $locked
+     * @return void
+     * @dataProvider modifyMetaLockedDataProvider
+     */
+    public function testModifyMetaLocked($locked)
+    {
+        $groupCode = 'test_group_code';
+        $meta = [
+            $groupCode => [
+                'children' => [
+                    'category_ids' => [
+                        'sortOrder' => 10,
+                    ],
+                ],
+            ],
+        ];
+
+        $this->arrayManagerMock->expects($this->any())
+            ->method('findPath')
+            ->willReturn('path');
+
+        $this->productMock->expects($this->any())
+            ->method('isLockedAttribute')
+            ->willReturn($locked);
+
+        $this->arrayManagerMock->expects($this->any())
+            ->method('merge')
+            ->willReturnArgument(2);
+
+        $modifyMeta = $this->createModel()->modifyMeta($meta);
+        $this->assertEquals($locked, $modifyMeta['arguments']['data']['config']['disabled']);
+    }
+
+    public function modifyMetaLockedDataProvider()
+    {
+        return [[true], [false]];
+    }
+
     public function testModifyMetaWithCaching()
     {
         $this->arrayManagerMock->expects($this->exactly(2))