Basket: manage basket share (ro and edit) - manage alt query own

7 files changed, 126 insertions, 23 deletions

diff --git a/archaeological_finds/forms.py b/archaeological_finds/forms.py
index 90e1390bf..811e71a60 100644
--- a/archaeological_finds/forms.py
+++ b/archaeological_finds/forms.py
@@ -57,7 +57,7 @@ from ishtar_common.forms import CustomForm, CustomFormSearch, FormSet, \
     PkWizardSearch
 from ishtar_common.forms_common import get_town_field
 from ishtar_common.models import valid_id, valid_ids, get_current_profile, \
-    SpatialReferenceSystem, Area, OperationType
+    SpatialReferenceSystem, Area, OperationType, IshtarUser
 from ishtar_common.utils import convert_coordinates_to_point
 
 __all__ = [
@@ -74,6 +74,7 @@ __all__ = [
     'DashboardTreatmentForm', 'DashboardTreatmentFileForm',
     'RecordFormSelection', 'FindForm', 'SimpleFindForm', 'DateForm',
     'DatingFormSet', 'PreservationForm', 'FindBasketFormSelection',
+    'FindBasketForWriteFormSelection',
     'FindBasketForm', 'FindSelect', 'FindFormSelection',
     'FindFormSelectionWarehouseModule', 'MultipleFindFormSelection',
     'MultipleFindFormSelectionWarehouseModule', 'FindMultipleFormSelection',
@@ -883,7 +884,8 @@ class FindSelect(HistorySelect):
             if self.current_user:
                 self.fields['basket'].choices += [
                     (b.pk, b.label) for b in models.FindBasket.objects.filter(
-                        user=self.current_user).all()]
+                        models.FindBasket.get_query_owns(self.current_user)
+                    ).all()]
 
     def get_input_ids(self):
         ids = super(FindSelect, self).get_input_ids()
@@ -1169,19 +1171,57 @@ class FindBasketFormSelection(CustomFormSearch):
         validators=[valid_id(models.FindBasket)])
 
 
+class FindBasketForWriteFormSelection(CustomFormSearch):
+    SEARCH_AND_SELECT = True
+    form_label = _("Basket search")
+    associated_models = {'pk': models.FindBasket}
+    currents = {'pk': models.FindBasket}
+
+    pk = forms.IntegerField(
+        label="", required=False,
+        widget=widgets.DataTable(
+            reverse_lazy('get-findbasket-write'),
+            FindBasketSelect, models.FindBasket,
+        ),
+        validators=[valid_id(models.FindBasket)])
+
+
 class FindBasketForm(IshtarForm):
     form_label = _(u"Find basket")
+    associated_models = {"shared_with": IshtarUser,
+                         "shared_write_with": IshtarUser}
     label = forms.CharField(
         label=_(u"Label"),
         validators=[validators.MaxLengthValidator(1000)])
     comment = forms.CharField(label=_(u"Comment"),
                               widget=forms.Textarea, required=False)
+    shared_with = widgets.Select2MultipleField(
+        model=IshtarUser, remote=True,
+        label=_(u"Shared (read) with"),
+        required=False, long_widget=True
+    )
+    shared_write_with = widgets.Select2MultipleField(
+        model=IshtarUser, remote=True,
+        label=_(u"Shared (read/edit) with"),
+        required=False, long_widget=True
+    )
 
 
-class NewFindBasketForm(forms.ModelForm):
+class NewFindBasketForm(forms.ModelForm, IshtarForm):
+    shared_with = widgets.Select2MultipleField(
+        model=IshtarUser, remote=True,
+        label=_(u"Shared (read) with"),
+        required=False, long_widget=True
+    )
+    shared_write_with = widgets.Select2MultipleField(
+        model=IshtarUser, remote=True,
+        label=_(u"Shared (read/edit) with"),
+        required=False, long_widget=True
+    )
+
     class Meta:
         model = models.FindBasket
-        fields = ('label', 'comment')
+        fields = ('label', 'comment', 'shared_with', 'shared_write_with')
 
     def __init__(self, *args, **kwargs):
         self.user = kwargs.pop('user')
@@ -1217,14 +1257,26 @@ class SelectFindBasketForm(IshtarForm):
         super(SelectFindBasketForm, self).__init__(*args, **kwargs)
         if not self.user:
             return
-        self.fields['basket'].choices = [('', '--')] + [
-            (b.pk, unicode(b))
+        self.fields['basket'].choices = self.get_basket_choices()
+
+    def get_basket_choices(self):
+        return [('', u'--')] + [
+            (str(b.pk), unicode(b))
             for b in models.FindBasket.objects.filter(
-                Q(user=self.user) | Q(shared_with=self.user)
-            )]
+                Q(user=self.user) | Q(shared_write_with=self.user)
+            )
+        ]
 
 
 class DeleteFindBasketForm(SelectFindBasketForm):
+    def get_basket_choices(self):
+        return [('', u'--')] + [
+            (str(b.pk), unicode(b))
+            for b in models.FindBasket.objects.filter(
+                Q(user=self.user)
+            )
+        ]
+
     def save(self):
         try:
             models.FindBasket.objects.get(pk=self.cleaned_data['basket'],
@@ -1242,8 +1294,8 @@ class FindBasketAddItemForm(forms.Form):
     def save(self, user):
         try:
             basket = models.FindBasket.objects.filter(
-                Q(user=user) | Q(shared_with=user)
-            ).get(pk=self.cleaned_data['basket_id'])
+                Q(user=user) | Q(shared_with=user) | Q(shared_write_with=user)
+            ).distinct().get(pk=self.cleaned_data['basket_id'])
             item = models.Find.objects.get(
                 pk=self.cleaned_data['item_id'])
         except models.FindBasket.DoesNotExist or\
diff --git a/archaeological_finds/migrations/0042_auto_20181129_1755.py b/archaeological_finds/migrations/0042_auto_20181129_1755.py
new file mode 100644
index 000000000..42d732cf2
--- /dev/null
+++ b/archaeological_finds/migrations/0042_auto_20181129_1755.py
@@ -0,0 +1,30 @@
+# -*- coding: utf-8 -*-
+# Generated by Django 1.11.10 on 2018-11-29 17:55
+from __future__ import unicode_literals
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('ishtar_common', '0077_auto_20181129_1755'),
+        ('archaeological_finds', '0041_auto_20181121_1225'),
+    ]
+
+    operations = [
+        migrations.AlterModelOptions(
+            name='treatmentfile',
+            options={'ordering': ('cached_label',), 'permissions': (('view_treatmentfile', 'Can view all Treatment requests'), ('view_own_treatmentfile', 'Can view own Treatment request'), ('add_own_treatmentfile', 'Can add own Treatment request'), ('change_own_treatmentfile', 'Can change own Treatment request'), ('delete_own_treatmentfile', 'Can delete own Treatment request')), 'verbose_name': 'Treatment request', 'verbose_name_plural': 'Treatment requests'},
+        ),
+        migrations.AddField(
+            model_name='findbasket',
+            name='shared_write_with',
+            field=models.ManyToManyField(blank=True, related_name='shared_write_findbaskets', to='ishtar_common.IshtarUser', verbose_name='Shared (read/edit) with'),
+        ),
+        migrations.AlterField(
+            model_name='findbasket',
+            name='shared_with',
+            field=models.ManyToManyField(blank=True, related_name='shared_findbaskets', to='ishtar_common.IshtarUser', verbose_name='Shared (read) with'),
+        ),
+    ]
diff --git a/archaeological_finds/models_finds.py b/archaeological_finds/models_finds.py
index 9baced4e0..0c9770186 100644
--- a/archaeological_finds/models_finds.py
+++ b/archaeological_finds/models_finds.py
@@ -591,6 +591,11 @@ class FindBasket(Basket, OwnPerms):
 
     @classmethod
     def get_query_owns(cls, ishtaruser):
+        return Q(user=ishtaruser) | Q(shared_with=ishtaruser) | Q(
+            shared_write_with=ishtaruser)
+
+    @classmethod
+    def get_write_query_owns(cls, ishtaruser):
         return Q(user=ishtaruser)
 
     def get_extra_actions(self, request):
@@ -599,13 +604,18 @@ class FindBasket(Basket, OwnPerms):
         """
         # url, base_text, icon, extra_text, extra css class, is a quick action
 
-        # no particular rights: if you can view an itm you can add it to your
-        # own basket
-        actions = [
-            (reverse("select_itemsinbasket", args=[self.pk]),
-             _(u"Manage basket"),
-             "fa fa-shopping-basket", "", "", False),
-        ]
+        if not request.user or not request.user.ishtaruser:
+            return []
+
+        ishtaruser = request.user.ishtaruser
+        actions = []
+        if self.user == ishtaruser or ishtaruser.pk in [
+                user.pk for user in self.shared_write_with.all()]:
+            actions = [
+                (reverse("select_itemsinbasket", args=[self.pk]),
+                 _(u"Manage basket"),
+                 "fa fa-shopping-basket", "", "", False),
+            ]
         return actions
 
 
diff --git a/archaeological_finds/templates/ishtar/sheet_findbasket.html b/archaeological_finds/templates/ishtar/sheet_findbasket.html
index 3c3ca1d3f..4a101d8f2 100644
--- a/archaeological_finds/templates/ishtar/sheet_findbasket.html
+++ b/archaeological_finds/templates/ishtar/sheet_findbasket.html
@@ -12,8 +12,9 @@
 <div class='row'>
     {% field_flex "Label" item.label %}
     {% field_flex_detail "Owned by" item.user.person %}
-    {% field_flex_multiple "Shared_with" item.shared_with %}
     {% field_flex "Comment" item.comment %}
+    {% field_flex_multiple_full "Shared (read) with" item.shared_with %}
+    {% field_flex_multiple_full "Shared (read/edit) with" item.shared_write_with %}
 </div>
 
 <h3>{% trans "Content" %}</h3>
diff --git a/archaeological_finds/urls.py b/archaeological_finds/urls.py
index 6e9f59b8c..0ef3bac89 100644
--- a/archaeological_finds/urls.py
+++ b/archaeological_finds/urls.py
@@ -45,6 +45,8 @@ urlpatterns = [
         views.find_modify, name='find_modify'),
     url(r'get-findbasket/$', views.get_find_basket,
         name='get-findbasket'),
+    url(r'get-findbasket-write/$', views.get_find_basket_for_write,
+        name='get-findbasket-write'),
     url(r'find_basket_search/(?P<step>.+)?$',
         check_rights(['view_find', 'view_own_find'])(
             views.basket_search_wizard), name='find_basket_search'),
diff --git a/archaeological_finds/views.py b/archaeological_finds/views.py
index 29f0f75af..125567044 100644
--- a/archaeological_finds/views.py
+++ b/archaeological_finds/views.py
@@ -109,12 +109,19 @@ show_find = show_item(models.Find, 'find')
 display_find = display_item(models.Find)
 revert_find = revert_item(models.Find)
 
-show_findbasket = show_item(models.FindBasket, 'findbasket')
+show_findbasket = show_item(models.FindBasket, 'findbasket',
+                            model_for_perms=models.Find)
 display_findbasket = display_item(models.FindBasket,
                                   show_url='show-find/basket-')
 
 get_find_basket = get_item(
     models.FindBasket, 'get_findbasket', 'findbasket',
+    model_for_perms=models.Find
+)
+
+get_find_basket_for_write = get_item(
+    models.FindBasket, 'get_findbasket', 'findbasket',
+    model_for_perms=models.Find, alt_query_own='get_write_query_owns'
 )
 
 basket_search_wizard = FindBasketSearch.as_view(
@@ -125,10 +132,10 @@ basket_search_wizard = FindBasketSearch.as_view(
 
 basket_modify_wizard = FindBasketEditWizard.as_view(
     [
-        ('selec-find_basket_modification', FindBasketFormSelection),
+        ('selec-find_basket_modification', FindBasketForWriteFormSelection),
         ('basket-find_basket_modification', FindBasketForm),
         ('final-find_basket_modification', FinalForm)
-     ],
+    ],
     label=_(u"Basket modify"),
     url_name='find_basket_modification',
 )
@@ -290,8 +297,8 @@ class OwnBasket(object):
     def get_basket(self, user, pk):
         try:
             return models.FindBasket.objects.filter(
-                Q(user=user) | Q(shared_with=user)
-            ).get(pk=pk)
+                Q(user=user) | Q(shared_with=user) | Q(shared_write_with=user)
+            ).distinct().get(pk=pk)
         except models.FindBasket.DoesNotExist:
             raise PermissionDenied
 
diff --git a/archaeological_finds/wizards.py b/archaeological_finds/wizards.py
index 43f48ab59..6d4fd2d95 100644
--- a/archaeological_finds/wizards.py
+++ b/archaeological_finds/wizards.py
@@ -500,3 +500,4 @@ class FindBasketWizard(Wizard):
 
 class FindBasketEditWizard(FindBasketWizard):
     edit = True
+    alt_is_own_method = 'get_write_query_owns'