Block viewing node allocations and location unless user has permission

Blocks viewing the allocation list and location for a node unless a
user has permission to view the node in the first place.

Author: DaneEveritt

app/Transformers/Admin/NodeTransformer.php

@@ -80,6 +80,10 @@ public function transform(Node $node)
      */
     public function includeAllocations(Node $node)
     {
+        if ($this->request && ! $this->request->apiKeyHasPermission('view-node')) {
+            return;
+        }
+
         return $this->collection($node->allocations, new AllocationTransformer, 'allocation');
     }
 
@@ -90,6 +94,10 @@ public function includeAllocations(Node $node)
      */
     public function includeLocation(Node $node)
     {
+        if ($this->request && ! $this->request->apiKeyHasPermission('view-node')) {
+            return;
+        }
+
         return $this->item($node->location, new LocationTransformer, 'location');
     }