fixed shopping list share permission

cookbook/helper/permission_helper.py

@@ -79,7 +79,7 @@ def is_object_shared(user, obj):
     #      share checks for relevant objects
     if not user.is_authenticated:
         return False
-    return user in obj.shared.all()
+    return user in obj.get_shared()
 
 
 def share_link_valid(recipe, share):

cookbook/models.py

@@ -45,6 +45,11 @@ class PermissionModelMixin:
             return self.user
         return None
 
+    def get_shared(self):
+        if getattr(self, 'shared', None):
+            return self.shared.all()
+        return []
+
     def get_space(self):
         p = '.'.join(self.get_space_key())
         if getattr(self, p, None):
@@ -549,6 +554,9 @@ class ShoppingListEntry(models.Model, PermissionModelMixin):
     def __str__(self):
         return f'Shopping list entry {self.id}'
 
+    def get_shared(self):
+        return self.shoppinglist_set.first().shared.all()
+
     def get_owner(self):
         try:
             return self.shoppinglist_set.first().created_by

cookbook/views/api.py

@@ -337,19 +337,19 @@ class RecipeViewSet(viewsets.ModelViewSet, StandardFilterMixin):
 class ShoppingListRecipeViewSet(viewsets.ModelViewSet):
     queryset = ShoppingListRecipe.objects
     serializer_class = ShoppingListRecipeSerializer
-    permission_classes = [CustomIsOwner, ]
+    permission_classes = [CustomIsOwner| CustomIsShared ]
 
     def get_queryset(self):
-        return self.queryset.filter(shoppinglist__created_by=self.request.user, shoppinglist__space=self.request.space).all()
+        return self.queryset.filter(Q(shoppinglist__created_by=self.request.user) | Q(shoppinglist__shared=self.request.user)).filter(shoppinglist__space=self.request.space).all()
 
 
 class ShoppingListEntryViewSet(viewsets.ModelViewSet):
     queryset = ShoppingListEntry.objects
     serializer_class = ShoppingListEntrySerializer
-    permission_classes = [CustomIsOwner, ]
+    permission_classes = [CustomIsOwner | CustomIsShared]
 
     def get_queryset(self):
-        return self.queryset.filter(shoppinglist__created_by=self.request.user, shoppinglist__space=self.request.space).all()
+        return self.queryset.filter(Q(shoppinglist__created_by=self.request.user) | Q(shoppinglist__shared=self.request.user)).filter(shoppinglist__space=self.request.space).all()
 
 
 class ShoppingListViewSet(viewsets.ModelViewSet):