logos-co/open-law
1
0
Fork 0
mirror of https://github.com/logos-co/open-law.git synced 2025-02-10 22:06:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix approve comment

Browse Source
This commit is contained in:
SvyatoslavArtymovych 2023-06-01 08:29:27 +03:00
parent 28b0946f6a
commit ad22cd0f82
2 changed files with 47 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

41
app/controllers/require_permission.py
View File

@ -3,6 +3,7 @@ from flask import flash, redirect, url_for, request, make_response
import functools import functools
from app import models as m, db from app import models as m, db
from app.logger import log
def check_permissions( def check_permissions(
@ -21,27 +22,47 @@ def check_permissions(
for model in entities: for model in entities:
entity_id_field = (model.__name__ + "_id").lower() entity_id_field = (model.__name__ + "_id").lower()
entity_id = request_args.get(entity_id_field) entity_id = request_args.get(entity_id_field)
entity: m.Book | m.Collection | m.Section | m.Interpretation = db.session.get( entity: m.Book | m.Collection | m.Section | m.Interpretation | m.Comment = (
model, entity_id db.session.get(model, entity_id)
) )
if entity is None: if entity is None:
log(log.INFO, "No entity [%s] found", entities)
flash("You do not have permission", "danger") flash("You do not have permission", "danger")
return make_response(redirect(url_for("home.get_all"))) return make_response(redirect(url_for("home.get_all")))
book_id = request_args.get("book_id") book_id = request_args.get("book_id")
if book_id:
book: m.Book = db.session.get(m.Book, book_id) book: m.Book = db.session.get(m.Book, book_id)
if book and book.user_id == current_user.id: if book and book.user_id == current_user.id:
# user has access because he is book owner # user has access because he is book owner
log(log.INFO, "User [%s] is book owner [%s]", current_user, book)
return None return None
if type(entity) == m.Comment:
log(log.INFO, "Entity is Comment. Replace it by entity.interpretation")
entity = entity.interpretation
if not entity or not entity.access_groups: if not entity or not entity.access_groups:
log(
log.INFO,
"User [%s] dont have permission to [%s] [%s]",
access.name,
current_user,
entity,
)
flash("You do not have permission", "warning") flash("You do not have permission", "warning")
return make_response(redirect(url_for("home.get_all"))) return make_response(redirect(url_for("home.get_all")))
# check if user is not owner of book # check if user is not owner of book
if not book and entity.access_groups[0].book.user_id == current_user.id: if not book_id and entity.access_groups[0].book.user_id == current_user.id:
# user has access because he is book owner # user has access because he is book owner
log(
log.INFO,
"User [%s] is book owner [%s]",
current_user,
entity.access_groups[0].book,
)
return None return None
access_group_query = ( access_group_query = (
@ -67,8 +88,22 @@ def check_permissions(
access_groups = access_group_query.all() access_groups = access_group_query.all()
if access_groups: if access_groups:
log(
log.INFO,
"User [%s] has permission to [%s] [%s]",
access.name,
current_user,
entity,
)
return return
log(
log.INFO,
"User [%s] dont have permission to [%s] [%s]",
access.name,
current_user,
entity,
)
flash("You do not have permission", "danger") flash("You do not have permission", "danger")
return make_response(redirect(url_for("home.get_all"))) return make_response(redirect(url_for("home.get_all")))

10
app/views/approve.py
View File

@ -61,19 +61,19 @@ def approve_interpretation(interpretation_id: int):
@bp.route( @bp.route(
"/comment/<int:interpretation_id>", "/comment/<int:comment_id>",
methods=["POST"], methods=["POST"],
) )
@require_permission( @require_permission(
entity_type=m.Permission.Entity.COMMENT, entity_type=m.Permission.Entity.COMMENT,
access=[m.Permission.Access.A], access=[m.Permission.Access.A],
entities=[m.Interpretation], entities=[m.Comment],
) )
@login_required @login_required
def approve_comment(interpretation_id: int): def approve_comment(comment_id: int):
comment: m.Comment = db.session.get(m.Comment, interpretation_id) comment: m.Comment = db.session.get(m.Comment, comment_id)
if not comment: if not comment:
log(log.WARNING, "Comment with id [%s] not found", interpretation_id) log(log.WARNING, "Comment with id [%s] not found", comment_id)
return jsonify({"message": "Comment not found"}), 404 return jsonify({"message": "Comment not found"}), 404
comment.approved = not comment.approved comment.approved = not comment.approved