diff --git a/cookbook/helper/permission_helper.py b/cookbook/helper/permission_helper.py index e170063f..794107f1 100644 --- a/cookbook/helper/permission_helper.py +++ b/cookbook/helper/permission_helper.py @@ -79,7 +79,7 @@ def is_object_shared(user, obj): # share checks for relevant objects if not user.is_authenticated: return False - return user in obj.shared.all() + return user in obj.get_shared() def share_link_valid(recipe, share): diff --git a/cookbook/models.py b/cookbook/models.py index 2e9237c9..20bd0f75 100644 --- a/cookbook/models.py +++ b/cookbook/models.py @@ -45,6 +45,11 @@ class PermissionModelMixin: return self.user return None + def get_shared(self): + if getattr(self, 'shared', None): + return self.shared.all() + return [] + def get_space(self): p = '.'.join(self.get_space_key()) if getattr(self, p, None): @@ -549,6 +554,9 @@ class ShoppingListEntry(models.Model, PermissionModelMixin): def __str__(self): return f'Shopping list entry {self.id}' + def get_shared(self): + return self.shoppinglist_set.first().shared.all() + def get_owner(self): try: return self.shoppinglist_set.first().created_by diff --git a/cookbook/views/api.py b/cookbook/views/api.py index 5718b2f0..862e60aa 100644 --- a/cookbook/views/api.py +++ b/cookbook/views/api.py @@ -337,19 +337,19 @@ class RecipeViewSet(viewsets.ModelViewSet, StandardFilterMixin): class ShoppingListRecipeViewSet(viewsets.ModelViewSet): queryset = ShoppingListRecipe.objects serializer_class = ShoppingListRecipeSerializer - permission_classes = [CustomIsOwner, ] + permission_classes = [CustomIsOwner| CustomIsShared ] def get_queryset(self): - return self.queryset.filter(shoppinglist__created_by=self.request.user, shoppinglist__space=self.request.space).all() + return self.queryset.filter(Q(shoppinglist__created_by=self.request.user) | Q(shoppinglist__shared=self.request.user)).filter(shoppinglist__space=self.request.space).all() class ShoppingListEntryViewSet(viewsets.ModelViewSet): queryset = ShoppingListEntry.objects serializer_class = ShoppingListEntrySerializer - permission_classes = [CustomIsOwner, ] + permission_classes = [CustomIsOwner | CustomIsShared] def get_queryset(self): - return self.queryset.filter(shoppinglist__created_by=self.request.user, shoppinglist__space=self.request.space).all() + return self.queryset.filter(Q(shoppinglist__created_by=self.request.user) | Q(shoppinglist__shared=self.request.user)).filter(shoppinglist__space=self.request.space).all() class ShoppingListViewSet(viewsets.ModelViewSet):