Require perms for all units for mass reject/restore options

Author: matti-lamppu

api/graphql/types/application/permissions.py

@@ -52,4 +52,4 @@ def has_update_permission(cls, instance: Application, user: AnyUser, input_data:
             )
             for unit_id in section.reservation_unit_options.all().values_list("reservation_unit__unit__id", flat=True)
         ]
-        return has_unit_permission(user, "can_handle_applications", units)
+        return all(has_unit_permission(user, "can_handle_applications", [unit]) for unit in units)

api/graphql/types/application_section/permissions.py

@@ -53,4 +53,4 @@ def has_update_permission(cls, instance: ApplicationSection, user: AnyUser, inpu
             return True
 
         units = list(instance.reservation_unit_options.all().values_list("reservation_unit__unit__id", flat=True))
-        return has_unit_permission(user, "can_handle_applications", units)
+        return all(has_unit_permission(user, "can_handle_applications", [unit]) for unit in units)

tests/test_graphql_api/test_application/test_reject_all_options.py

@@ -1,7 +1,7 @@
 import pytest
 
 from applications.choices import Weekday
-from tests.factories import ApplicationFactory, UserFactory
+from tests.factories import ApplicationFactory, ReservationUnitOptionFactory, UserFactory, add_unit_permissions
 
 from .helpers import REJECT_MUTATION
 
@@ -67,3 +67,39 @@ def test_application__reject_all_options__unit_admin(graphql):
     response = graphql(REJECT_MUTATION, input_data={"pk": application.pk})
 
     assert response.has_errors is False
+
+
+def test_application__reject_all_options__unit_admin__no_permission_for_all_units(graphql):
+    application = ApplicationFactory.create_in_status_in_allocation()
+    section = application.application_sections.first()
+
+    ReservationUnitOptionFactory.create(application_section=section)
+
+    unit = section.reservation_unit_options.first().reservation_unit.unit
+    admin = UserFactory.create_with_unit_permissions(unit=unit, perms=["can_handle_applications"])
+    graphql.force_login(admin)
+
+    response = graphql(REJECT_MUTATION, input_data={"pk": application.pk})
+
+    assert response.error_message() == "No permission to update."
+
+
+def test_application__reject_all_options__unit_admin__has_permission_for_all_units(graphql):
+    application = ApplicationFactory.create_in_status_in_allocation()
+    section = application.application_sections.first()
+
+    option_1 = section.reservation_unit_options.first()
+    option_2 = ReservationUnitOptionFactory.create(application_section=section)
+
+    unit_1 = option_1.reservation_unit.unit
+    unit_2 = option_2.reservation_unit.unit
+
+    admin = UserFactory.create()
+    add_unit_permissions(admin, unit=unit_1, perms=["can_handle_applications"])
+    add_unit_permissions(admin, unit=unit_2, perms=["can_handle_applications"])
+
+    graphql.force_login(admin)
+
+    response = graphql(REJECT_MUTATION, input_data={"pk": application.pk})
+
+    assert response.has_errors is False, response.errors

tests/test_graphql_api/test_application/test_restore_all_options.py

@@ -1,6 +1,6 @@
 import pytest
 
-from tests.factories import ApplicationFactory, UserFactory
+from tests.factories import ApplicationFactory, ReservationUnitOptionFactory, UserFactory, add_unit_permissions
 
 from .helpers import RESTORE_MUTATION
 
@@ -49,3 +49,39 @@ def test_application__restore_all_options__unit_admin(graphql):
     response = graphql(RESTORE_MUTATION, input_data={"pk": application.pk})
 
     assert response.has_errors is False
+
+
+def test_application__restore_all_options__unit_admin__no_permission_for_all_units(graphql):
+    application = ApplicationFactory.create_in_status_in_allocation()
+    section = application.application_sections.first()
+
+    ReservationUnitOptionFactory.create(application_section=section)
+
+    unit = section.reservation_unit_options.first().reservation_unit.unit
+    admin = UserFactory.create_with_unit_permissions(unit=unit, perms=["can_handle_applications"])
+    graphql.force_login(admin)
+
+    response = graphql(RESTORE_MUTATION, input_data={"pk": application.pk})
+
+    assert response.error_message() == "No permission to update."
+
+
+def test_application__restore_all_options__unit_admin__has_permission_for_all_units(graphql):
+    application = ApplicationFactory.create_in_status_in_allocation()
+    section = application.application_sections.first()
+
+    option_1 = section.reservation_unit_options.first()
+    option_2 = ReservationUnitOptionFactory.create(application_section=section)
+
+    unit_1 = option_1.reservation_unit.unit
+    unit_2 = option_2.reservation_unit.unit
+
+    admin = UserFactory.create()
+    add_unit_permissions(admin, unit=unit_1, perms=["can_handle_applications"])
+    add_unit_permissions(admin, unit=unit_2, perms=["can_handle_applications"])
+
+    graphql.force_login(admin)
+
+    response = graphql(RESTORE_MUTATION, input_data={"pk": application.pk})
+
+    assert response.has_errors is False, response.errors

tests/test_graphql_api/test_application_section/test_reject_all_options.py

@@ -1,7 +1,7 @@
 import pytest
 
 from applications.choices import Weekday
-from tests.factories import ApplicationSectionFactory, UserFactory
+from tests.factories import ApplicationSectionFactory, ReservationUnitOptionFactory, UserFactory, add_unit_permissions
 
 from .helpers import REJECT_MUTATION
 
@@ -64,3 +64,37 @@ def test_application_section__reject_all_options__unit_admin(graphql):
     response = graphql(REJECT_MUTATION, input_data={"pk": application_section.pk})
 
     assert response.has_errors is False
+
+
+def test_application_section__reject_all_options__unit_admin__no_permission_for_all_units(graphql):
+    section = ApplicationSectionFactory.create_in_status_in_allocation()
+
+    ReservationUnitOptionFactory.create(application_section=section)
+
+    unit = section.reservation_unit_options.first().reservation_unit.unit
+    admin = UserFactory.create_with_unit_permissions(unit=unit, perms=["can_handle_applications"])
+    graphql.force_login(admin)
+
+    response = graphql(REJECT_MUTATION, input_data={"pk": section.pk})
+
+    assert response.error_message() == "No permission to update."
+
+
+def test_application_section__reject_all_options__unit_admin__has_permission_for_all_units(graphql):
+    section = ApplicationSectionFactory.create_in_status_in_allocation()
+
+    option_1 = section.reservation_unit_options.first()
+    option_2 = ReservationUnitOptionFactory.create(application_section=section)
+
+    unit_1 = option_1.reservation_unit.unit
+    unit_2 = option_2.reservation_unit.unit
+
+    admin = UserFactory.create()
+    add_unit_permissions(admin, unit=unit_1, perms=["can_handle_applications"])
+    add_unit_permissions(admin, unit=unit_2, perms=["can_handle_applications"])
+
+    graphql.force_login(admin)
+
+    response = graphql(REJECT_MUTATION, input_data={"pk": section.pk})
+
+    assert response.has_errors is False, response.errors

tests/test_graphql_api/test_application_section/test_restore_all_options.py

@@ -1,6 +1,6 @@
 import pytest
 
-from tests.factories import ApplicationSectionFactory, UserFactory
+from tests.factories import ApplicationSectionFactory, ReservationUnitOptionFactory, UserFactory, add_unit_permissions
 
 from .helpers import RESTORE_MUTATION
 
@@ -47,3 +47,37 @@ def test_application_section__restore_all_options__unit_admin(graphql):
     response = graphql(RESTORE_MUTATION, input_data={"pk": application_section.pk})
 
     assert response.has_errors is False
+
+
+def test_application_section__restore_all_options__unit_admin__no_permission_for_all_units(graphql):
+    section = ApplicationSectionFactory.create_in_status_in_allocation()
+
+    ReservationUnitOptionFactory.create(application_section=section)
+
+    unit = section.reservation_unit_options.first().reservation_unit.unit
+    admin = UserFactory.create_with_unit_permissions(unit=unit, perms=["can_handle_applications"])
+    graphql.force_login(admin)
+
+    response = graphql(RESTORE_MUTATION, input_data={"pk": section.pk})
+
+    assert response.error_message() == "No permission to update."
+
+
+def test_application_section__restore_all_options__unit_admin__has_permission_for_all_units(graphql):
+    section = ApplicationSectionFactory.create_in_status_in_allocation()
+
+    option_1 = section.reservation_unit_options.first()
+    option_2 = ReservationUnitOptionFactory.create(application_section=section)
+
+    unit_1 = option_1.reservation_unit.unit
+    unit_2 = option_2.reservation_unit.unit
+
+    admin = UserFactory.create()
+    add_unit_permissions(admin, unit=unit_1, perms=["can_handle_applications"])
+    add_unit_permissions(admin, unit=unit_2, perms=["can_handle_applications"])
+
+    graphql.force_login(admin)
+
+    response = graphql(RESTORE_MUTATION, input_data={"pk": section.pk})
+
+    assert response.has_errors is False, response.errors