Changeset c5922c7 in rattail-demo

Timestamp:

08/06/2020 01:53:45 AM (3 years ago)

Author:

Lance Edgar <lance@…>

Branches:

master

Children:

ebe0c2b

Parents:

25a7d46

Message:

Be smarter about how we prevent edit/delete for some people, employees

instead of just hard-coding UUID for 'chuck'

Location:

rattail_demo/web/views

Files:

• employees.py (modified) (2 diffs)
• people.py (modified) (2 diffs)

rattail_demo/web/views/employees.py

@@ -1 @@
-# -*- coding: utf-8 -*-
+# -*- coding: utf-8; -*-
 """
 Employee views
 """
 
-from __future__ import unicode_literals, absolute_import
-
 from tailbone.views import employees as base
+from tailbone.config import protected_usernames
 
 
-class EmployeesView(base.EmployeesView):
+class EmployeeView(base.EmployeesView):
     """
     Prevent edit/delete for Chuck Norris
     """
 
+    def __init__(self, request, **kwargs):
+        super(EmployeeView, self).__init__(request, **kwargs)
+        self.protected_usernames = protected_usernames(self.rattail_config)
+
+    def is_employee_protected(self, employee):
+        if self.protected_usernames:
+            for user in employee.person.users:
+                if user.username in self.protected_usernames:
+                    return True
+        return False
+
     def editable_instance(self, employee):
-        return employee.person_uuid != '30d1fe06bcf411e6a7c23ca9f40bc550'
+        if self.request.is_root:
+            return True
+        return not self.is_employee_protected(employee)
 
     def deletable_instance(self, employee):
-        return employee.person_uuid != '30d1fe06bcf411e6a7c23ca9f40bc550'
+        if self.request.is_root:
+            return True
+        return not self.is_employee_protected(employee)
 
 
@@ -28 +42 @@
                     renderer='json', permission='employees.list')
 
-    EmployeesView.defaults(config)
+    EmployeeView.defaults(config)

rattail_demo/web/views/people.py

@@ -6 +6 @@
 from tailbone.views import people as base
 from tailbone_corepos.views import people as corepos_base
+from tailbone.config import protected_usernames
 
 
@@ -13 +14 @@
     """
 
+    def __init__(self, request, **kwargs):
+        super(PersonView, self).__init__(request, **kwargs)
+        self.protected_usernames = protected_usernames(self.rattail_config)
+
+    def is_person_protected(self, person):
+        if self.protected_usernames:
+            for user in person.users:
+                if user.username in self.protected_usernames:
+                    return True
+        return False
+
     def editable_instance(self, person):
-        return person.uuid != '30d1fe06bcf411e6a7c23ca9f40bc550'
+        if self.request.is_root:
+            return True
+        return not self.is_person_protected(person)
 
     def deletable_instance(self, person):
-        return person.uuid != '30d1fe06bcf411e6a7c23ca9f40bc550'
+        if self.request.is_root:
+            return True
+        return not self.is_person_protected(person)