fixed sharing and added additional tests

cookbook/serializer.py

@@ -91,7 +91,10 @@ class CustomOnHandField(serializers.Field):
         if request := self.context.get('request', None):
             shared_users = getattr(request, '_shared_users', None)
         if shared_users is None:
+            try:
                 shared_users = [x.id for x in list(self.context['request'].user.get_shopping_share())] + [self.context['request'].user.id]
+            except AttributeError:  # Anonymous users (using share links) don't have shared users
+                shared_users = []
         return obj.onhand_users.filter(id__in=shared_users).exists()
 
     def to_internal_value(self, data):
@@ -863,7 +866,6 @@ class ExportLogSerializer(serializers.ModelSerializer):
         read_only_fields = ('created_by',)
 
 
-
 class AutomationSerializer(serializers.ModelSerializer):
 
     def create(self, validated_data):

cookbook/tests/api/test_api_recipe.py

@@ -4,7 +4,7 @@ import pytest
 from django.urls import reverse
 from django_scopes import scopes_disabled
 
-from cookbook.models import Recipe
+from cookbook.models import Recipe, ShareLink
 from cookbook.tests.conftest import get_random_json_recipe, validate_recipe
 
 LIST_URL = 'api:recipe-list'
@@ -38,6 +38,21 @@ def test_list_space(recipe_1_s1, u1_s1, u1_s2, space_2):
     assert len(json.loads(u1_s2.get(reverse(LIST_URL)).content)['results']) == 1
 
 
+def test_share_permission(recipe_1_s1, u1_s1, u1_s2, a_u):
+    assert u1_s1.get(reverse(DETAIL_URL, args=[recipe_1_s1.pk])).status_code == 200
+    assert u1_s2.get(reverse(DETAIL_URL, args=[recipe_1_s1.pk])).status_code == 404
+
+    with scopes_disabled():
+        r = u1_s1.get(reverse('new_share_link', kwargs={'pk': recipe_1_s1.pk}))
+        assert r.status_code == 302
+        r = u1_s2.get(reverse('new_share_link', kwargs={'pk': recipe_1_s1.pk}))
+        assert r.status_code == 404
+        share = ShareLink.objects.filter(recipe=recipe_1_s1).first()
+        assert a_u.get(reverse(DETAIL_URL, args=[recipe_1_s1.pk]) + f'?share={share.uuid}').status_code == 200
+        assert u1_s1.get(reverse(DETAIL_URL, args=[recipe_1_s1.pk]) + f'?share={share.uuid}').status_code == 200
+        assert u1_s2.get(reverse(DETAIL_URL, args=[recipe_1_s1.pk]) + f'?share={share.uuid}').status_code == 404  # TODO fix in https://github.com/TandoorRecipes/recipes/issues/1238
+
+
 @pytest.mark.parametrize("arg", [
     ['a_u', 403],
     ['g1_s1', 200],

cookbook/views/api.py

@@ -648,11 +648,13 @@ class RecipeViewSet(viewsets.ModelViewSet):
     schema = QueryParamAutoSchema()
 
     def get_queryset(self):
+        share = self.request.query_params.get('share', None)
+
         if self.detail:
+            if not share:
                 self.queryset = self.queryset.filter(space=self.request.space)
             return super().get_queryset()
 
-        share = self.request.query_params.get('share', None)
         if not (share and self.detail):
             self.queryset = self.queryset.filter(space=self.request.space)
 

vue/src/apps/RecipeView/RecipeView.vue

@@ -221,7 +221,7 @@ export default {
         this.$i18n.locale = window.CUSTOM_LOCALE
         this.requestWakeLock()
     },
-    beforeDestroy() {
+    beforeUnmount() {
         this.destroyWakeLock()
     },
     methods: {