|
1 | | -from rest_framework.exceptions import PermissionDenied |
2 | | -from rest_framework.response import Response |
3 | 1 | from rest_framework import status |
4 | 2 | from rest_framework.decorators import api_view |
| 3 | +from rest_framework.exceptions import PermissionDenied |
| 4 | +from rest_framework.response import Response |
| 5 | +from scheduler.serializers import UserSerializer |
5 | 6 |
|
| 7 | +from ..models import Coordinator, Mentor, Student, User |
6 | 8 | from .utils import viewset_with |
7 | | -from ..models import Coordinator, User |
8 | | -from scheduler.serializers import UserSerializer |
| 9 | + |
| 10 | +# can create pytest to test this |
9 | 11 |
|
10 | 12 |
|
11 | 13 | class UserViewSet(*viewset_with("list")): |
12 | 14 | serializer_class = None |
13 | 15 | queryset = User.objects.all() |
14 | 16 |
|
15 | 17 | def list(self, request): |
| 18 | + """ |
| 19 | + Lists the emails of all users in the system. Only accessible by coordinators and superusers. |
| 20 | + """ |
16 | 21 | if not ( |
17 | | - request.user.is_superuser |
18 | | - or Coordinator.objects.filter(user=request.user).exists() |
| 22 | + # request.user.is_superuser or |
| 23 | + Coordinator.objects.filter(user=request.user).exists() |
19 | 24 | ): |
20 | 25 | raise PermissionDenied( |
21 | 26 | "Only coordinators and superusers may view the user email list" |
22 | 27 | ) |
23 | 28 | return Response(self.queryset.order_by("email").values_list("email", flat=True)) |
24 | 29 |
|
25 | 30 |
|
| 31 | +def has_permission(request_user, target_user): |
| 32 | + """ |
| 33 | + Returns True if the user has permission to access or edit the target user's profile |
| 34 | + """ |
| 35 | + # Does not account for users who are both mentors and students of different courses |
| 36 | + # need separation of concerns: |
| 37 | + # coordinators/mentor should only have coordinator/mentor access for their course |
| 38 | + # Check if request_user is a mentor |
| 39 | + if Mentor.objects.filter(user=request_user).exists(): |
| 40 | + mentor_courses = Mentor.objects.filter(user=request_user).values_list( |
| 41 | + "course", flat=True |
| 42 | + ) |
| 43 | + |
| 44 | + if Student.objects.filter(user=target_user, course__in=mentor_courses).exists(): |
| 45 | + return True |
| 46 | + if Mentor.objects.filter(user=target_user, course__in=mentor_courses).exists(): |
| 47 | + return True |
| 48 | + |
| 49 | + # Check if request_user is a student in the same course as target_user |
| 50 | + # Students in the same section can see each other |
| 51 | + if ( |
| 52 | + Student.objects.filter(user=request_user).exists() |
| 53 | + and Student.objects.filter(user=target_user).exists() |
| 54 | + ): |
| 55 | + request_user_courses = Student.objects.filter(user=request_user).values_list( |
| 56 | + "course", flat=True |
| 57 | + ) |
| 58 | + target_user_courses = Student.objects.filter(user=target_user).values_list( |
| 59 | + "course", flat=True |
| 60 | + ) |
| 61 | + |
| 62 | + if set(request_user_courses) & set(target_user_courses): |
| 63 | + return True |
| 64 | + |
| 65 | + # Coordinator access |
| 66 | + if Coordinator.objects.filter( |
| 67 | + user=request_user |
| 68 | + ).exists(): # or if request_user.is_superuser |
| 69 | + return True |
| 70 | + |
| 71 | + # Request user accessing their own profile |
| 72 | + if request_user == target_user: |
| 73 | + return True |
| 74 | + |
| 75 | + return False |
| 76 | + |
| 77 | + |
26 | 78 | @api_view(["GET"]) |
27 | | -def userinfo(request): |
| 79 | +def user_retrieve(request, pk): |
28 | 80 | """ |
29 | | - Get user info for request user |
| 81 | + Retrieve user profile. Only accessible by superusers and the user themselves. |
| 82 | + """ |
| 83 | + try: |
| 84 | + user = User.objects.get(pk=pk) |
| 85 | + except User.DoesNotExist: |
| 86 | + return Response({"detail": "Not found."}, status=status.HTTP_404_NOT_FOUND) |
| 87 | + |
| 88 | + if not has_permission(request.user, user): |
| 89 | + raise PermissionDenied("You do not have permission to access this profile") |
30 | 90 |
|
31 | | - TODO: perhaps replace this with a viewset when we establish profiles |
| 91 | + serializer = UserSerializer(user) |
| 92 | + return Response(serializer.data) |
| 93 | + |
| 94 | + |
| 95 | +@api_view(["PUT"]) |
| 96 | +def user_update(request, pk): |
| 97 | + """ |
| 98 | + Update user profile. Only accessible by Coordinators and the user themselves. |
| 99 | + """ |
| 100 | + try: |
| 101 | + user = User.objects.get(pk=pk) |
| 102 | + except User.DoesNotExist: |
| 103 | + return Response({"detail": "Not found."}, status=status.HTTP_404_NOT_FOUND) |
| 104 | + |
| 105 | + if not ( |
| 106 | + (request.user == user) or Coordinator.objects.filter(user=request.user).exists() |
| 107 | + ): |
| 108 | + raise PermissionDenied("You do not have permission to edit this profile") |
| 109 | + |
| 110 | + serializer = UserSerializer(user, data=request.data, partial=True) |
| 111 | + if serializer.is_valid(): |
| 112 | + serializer.save() |
| 113 | + return Response(serializer.data) |
| 114 | + return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST) |
| 115 | + |
| 116 | + |
| 117 | +@api_view(["GET"]) |
| 118 | +def user_info(request): |
| 119 | + """ |
| 120 | + Get user info for request user |
32 | 121 | """ |
33 | 122 | serializer = UserSerializer(request.user) |
34 | 123 | return Response(serializer.data, status=status.HTTP_200_OK) |
0 commit comments