fix: properly apply auth to corrections in sheet table

Fixes #700

src/Handler/Sheet/List.hs

@@ -93,11 +93,8 @@ getSheetListR tid ssh csh = do
                       cid' <- encrypt sid
                       return $ CSubmissionR tid ssh csh sheetName cid' CorrectionR
                     acell = anchorCellM mkRoute $(widgetFile "widgets/rating/rating")
-                    tellStats = do
-                      r <- mkRoute
-                      showRating <- lift $ hasReadAccessTo r
-                      tell . stats $ bool Nothing submissionRatingPoints showRating
-                in acell & cellContents %~ (<* tellStats)
+                    tellStats = tell $ stats submissionRatingPoints
+                in guardAuthCell ((, False) <$> mkRoute) $ acell & cellContents %~ (<* tellStats)
 
       , sortable Nothing -- (Just "percent")
                         (i18nCell MsgRatingPercent)
@@ -105,10 +102,13 @@ getSheetListR tid ssh csh = do
               (Just (Entity sid Submission{submissionRatingPoints=Just sPoints})) ->
                 case preview (_grading . _maxPoints) sType of
                   Just maxPoints
-                    | maxPoints /= 0 -> cell $ do
-                        cID <- encrypt sid
-                        showRating <- hasReadAccessTo $ CSubmissionR tid ssh csh sheetName cID CorrectionR
-                        bool (return ()) (toWidget . toMessage $ textPercent sPoints maxPoints) showRating
+                    | maxPoints /= 0 ->
+                        let
+                          mkRoute = liftHandler $ do
+                            cid' <- encrypt sid
+                            return $ CSubmissionR tid ssh csh sheetName cid' CorrectionR
+                        in guardAuthCell ((, False) <$> mkRoute) . cell $ do
+                             toWidget . toMessage $ textPercent sPoints maxPoints
                   _other -> mempty
               _other -> mempty
       ]

src/Handler/Utils/Table/Cells.hs

@@ -65,6 +65,13 @@ linkEmptyCell = anchorCell
 msgCell :: (ToMessage t, IsDBTable m a) => t -> DBCell m a
 msgCell = textCell . toMessage
 
+guardAuthCell :: (IsDBTable m a, MonadAP m, MonadThrow m)
+              => m (Route UniWorX, Bool) -- ^ @(route, isWrite)@
+              -> DBCell m a -> DBCell m a
+guardAuthCell mkParams = over cellContents $ \act -> do
+  (route, isWrite) <- lift mkParams
+  ifM (fmap (is _Authorized) . lift $ evalAccess route isWrite) act (return mempty)
+
 -- Recall: for line numbers, use dbRow
 
 ---------------------