Merge pull request #316 from betagouv/pole-creation-responses

Fix pour permettre des répondant·e·s d'un pôle d'accéder aux enquêtes de l'organisation

Author: alemangui

backend/responses/permissions.py

@@ -24,5 +24,9 @@ def has_permission(self, request, view):
         if qs.filter(pole__isnull=True).exists():
             return True
 
-        # Un·e RESPONDER au niveau d'un pôle ne peut répondre qu'aux enquêtes de ce pôle
-        return survey.pole is not None and qs.filter(pole=survey.pole).exists()
+        # Un·e RESPONDER au niveau d'un pôle peut répondre :
+        # - aux enquêtes de son pôle spécifique
+        # - aux enquêtes au niveau organisation (sans pôle)
+        if survey.pole is None:
+            return qs.filter(pole__isnull=False).exists()
+        return qs.filter(pole=survey.pole).exists()

backend/responses/tests/test_create_response.py

@@ -159,13 +159,13 @@ def test_pole_responder_can_create_response_for_their_pole_survey(self):
         self.assertEqual(response.status_code, status.HTTP_201_CREATED)
 
     @authenticate
-    def test_pole_responder_cannot_create_response_for_org_level_survey(self):
+    def test_pole_responder_can_create_response_for_org_level_survey(self):
         """
-        Un·e RESPONDER de pôle ne peut pas répondre à une enquête au niveau organisation (sans pôle)
+        Un·e RESPONDER de pôle peut répondre à une enquête au niveau organisation (sans pôle)
         """
         org = OrganisationFactory()
         pole = PoleFactory(organisation=org)
-        survey = SurveyFactory(organisation=org)
+        survey = SurveyFactory(organisation=org, pole=None)
         MembershipFactory(
             user=authenticate.user, organisation=org, pole=pole, membership_type=MembershipType.RESPONDER
         )
@@ -174,7 +174,7 @@ def test_pole_responder_cannot_create_response_for_org_level_survey(self):
             response_payload(survey),
             format="json",
         )
-        self.assertEqual(response.status_code, status.HTTP_403_FORBIDDEN)
+        self.assertEqual(response.status_code, status.HTTP_201_CREATED)
 
     @authenticate
     def test_pole_responder_cannot_create_response_for_other_pole_survey(self):

backend/surveys/tests/test_list_survey.py

@@ -60,24 +60,25 @@ def test_org_member_sees_pole_surveys_within_org(self):
         self.assertEqual(json_response[0]["id"], survey.id)
 
     @authenticate
-    def test_pole_member_sees_only_their_pole_surveys(self):
+    def test_pole_member_sees_pole_and_org_level_surveys(self):
         """
-        Un membre d'un pôle voit uniquement les enquêtes de ce pôle, pas les enquêtes au niveau organisation
+        Un RESPONDER rattaché à un pôle voit les enquêtes de ce pôle
+        ET les enquêtes au niveau organisation (sans pôle)
         """
         org = OrganisationFactory()
         pole = PoleFactory(organisation=org)
         pole_survey = SurveyFactory(organisation=org, pole=pole)
-        SurveyFactory(organisation=org, pole=None)
+        org_survey = SurveyFactory(organisation=org, pole=None)
         MembershipFactory(
             user=authenticate.user, organisation=org, pole=pole, membership_type=MembershipType.RESPONDER
         )
 
         response = self.client.get(reverse("survey_list_create"), format="json")
         self.assertEqual(response.status_code, status.HTTP_200_OK)
 
-        json_response = response.json()
-        self.assertEqual(len(json_response), 1)
-        self.assertEqual(json_response[0]["id"], pole_survey.id)
+        ids = [s["id"] for s in response.json()]
+        self.assertIn(pole_survey.id, ids)
+        self.assertIn(org_survey.id, ids)
 
     @authenticate
     def test_pole_member_cannot_see_other_pole_surveys(self):

backend/surveys/tests/test_retrieve_survey.py

@@ -101,9 +101,9 @@ def test_pole_responder_can_retrieve_their_pole_survey(self):
         self.assertEqual(response.json()["id"], survey.id)
 
     @authenticate
-    def test_pole_responder_cannot_retrieve_org_level_survey(self):
+    def test_pole_responder_can_retrieve_org_level_survey(self):
         """
-        Un·e RESPONDER de pôle ne peut pas accéder à une enquête au niveau organisation (sans pôle)
+        Un·e RESPONDER de pôle peut accéder à une enquête au niveau organisation (sans pôle)
         """
         org = OrganisationFactory()
         pole = PoleFactory(organisation=org)
@@ -114,7 +114,8 @@ def test_pole_responder_cannot_retrieve_org_level_survey(self):
 
         response = self.client.get(survey_url(survey.id), format="json")
 
-        self.assertEqual(response.status_code, status.HTTP_404_NOT_FOUND)
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+        self.assertEqual(response.json()["id"], survey.id)
 
     @authenticate
     def test_pole_responder_cannot_retrieve_survey_from_other_pole(self):
@@ -362,9 +363,9 @@ def test_pole_responder_sees_their_pole_surveys(self):
         self.assertIn(survey.id, ids)
 
     @authenticate
-    def test_pole_responder_cannot_see_org_level_surveys(self):
+    def test_pole_responder_sees_org_level_surveys(self):
         """
-        Un·e RESPONDER de pôle ne voit pas les enquêtes au niveau organisation (sans pôle)
+        Un·e RESPONDER de pôle voit aussi les enquêtes au niveau organisation (sans pôle)
         """
         org = OrganisationFactory()
         pole = PoleFactory(organisation=org)
@@ -377,7 +378,7 @@ def test_pole_responder_cannot_see_org_level_surveys(self):
 
         self.assertEqual(response.status_code, status.HTTP_200_OK)
         ids = [s["id"] for s in response.json()]
-        self.assertNotIn(org_survey.id, ids)
+        self.assertIn(org_survey.id, ids)
 
     @authenticate
     def test_pole_responder_cannot_see_other_pole_surveys(self):

backend/surveys/views/survey.py

@@ -15,8 +15,16 @@ def get_queryset(self):
 
         org_ids = Membership.objects.filter(user=user, pole__isnull=True).values_list("organisation_id", flat=True)
         pole_ids = Membership.objects.filter(user=user, pole__isnull=False).values_list("pole_id", flat=True)
+        # Les RESPONDER rattachés à un pôle voient aussi les enquêtes au niveau organisation
+        responder_pole_org_ids = Membership.objects.filter(
+            user=user, pole__isnull=False, membership_type=MembershipType.RESPONDER
+        ).values_list("organisation_id", flat=True)
 
-        return Survey.objects.filter(Q(organisation_id__in=org_ids) | Q(pole_id__in=pole_ids))
+        return Survey.objects.filter(
+            Q(organisation_id__in=org_ids)
+            | Q(pole_id__in=pole_ids)
+            | Q(organisation_id__in=responder_pole_org_ids, pole__isnull=True)
+        ).distinct()
 
 
 class SurveyListCreateAPIView(SurveyQuerySetMixin, ListCreateAPIView):
@@ -50,11 +58,20 @@ def get_queryset(self):
             user=user, membership_type=MembershipType.RESPONDER, pole__isnull=True
         ).values_list("organisation_id", flat=True)
 
-        pole_ids = Membership.objects.filter(
-            user=user, membership_type=MembershipType.RESPONDER, pole__isnull=False
-        ).values_list("pole_id", flat=True)
+        pole_memberships = list(
+            Membership.objects.filter(user=user, membership_type=MembershipType.RESPONDER, pole__isnull=False).values(
+                "pole_id", "organisation_id"
+            )
+        )
+
+        pole_ids = [m["pole_id"] for m in pole_memberships]
+        pole_org_ids = [m["organisation_id"] for m in pole_memberships]
 
-        return Survey.objects.filter(Q(organisation_id__in=org_ids) | Q(pole_id__in=pole_ids))
+        return Survey.objects.filter(
+            Q(organisation_id__in=org_ids)
+            | Q(pole_id__in=pole_ids)
+            | Q(organisation_id__in=pole_org_ids, pole__isnull=True)
+        ).distinct()
 
 
 class SurveyRetrieveAPIView(SurveyQuerySetMixin, RetrieveAPIView):

mobile/android/app/build.gradle

@@ -7,8 +7,8 @@ android {
         applicationId "fr.gouv.beta.sylvasan"
         minSdkVersion rootProject.ext.minSdkVersion
         targetSdkVersion rootProject.ext.targetSdkVersion
-        versionCode 12
-        versionName "0.0.12"
+        versionCode 13
+        versionName "0.0.13"
         testInstrumentationRunner "androidx.test.runner.AndroidJUnitRunner"
         aaptOptions {
              // Files and dirs to omit from the packaged assets dir, modified to accommodate modern web apps.

mobile/src/composables/useMapPins.ts

@@ -36,13 +36,13 @@ function getSurveyTitle(response: LocalResponse | ResponseFull): string {
 
 export function useMapPins(mapRef: ShallowRef<maplibregl.Map | null>) {
   const { allResponses } = storeToRefs(useResponsesStore())
-  const { getSurveyById } = useSurveysStore()
+  const { getSurveyById } = storeToRefs(useSurveysStore())
 
   const selectedPin = ref<PinData | null>(null)
 
   const pins = computed<PinData[]>(() =>
     allResponses.value.flatMap((response) => {
-      const schema = getSchema(response, getSurveyById)
+      const schema = getSchema(response, getSurveyById.value)
       if (!schema) return []
 
       const mapField = schema.fields.find((f) => f.ui?.widget === "map")

mobile/src/pages/PositionPage.vue

@@ -127,7 +127,7 @@ onBeforeUnmount(() => {
       <div v-else class="relative h-full">
         <div
           ref="mapContainer"
-          :class="{ 'w-full': true, 'h-full': true, hidden: !tilesLoaded }"
+          :class="{ 'w-full': true, 'h-full': true, invisible: !tilesLoaded }"
         />
 
         <Transition name="fade">

mobile/src/pages/ResponseListPage/index.vue

@@ -20,8 +20,17 @@ import type { ResponseFull, LocalResponse } from "@shared-types/response"
 const responsesStore = useResponsesStore()
 const surveysStore = useSurveysStore()
 
-const draftResponses = computed(() => responsesStore.drafts)
-const allResponses = computed(() => responsesStore.allResponses)
+const byDateDesc = (
+  a: LocalResponse | ResponseFull,
+  b: LocalResponse | ResponseFull
+) => new Date(b.creationDate).getTime() - new Date(a.creationDate).getTime()
+
+const draftResponses = computed(() =>
+  [...responsesStore.drafts].sort(byDateDesc)
+)
+const allResponses = computed(() =>
+  [...responsesStore.allResponses].sort(byDateDesc)
+)
 const nondraftResponses = computed(() =>
   allResponses.value.filter((x) => x.status !== "draft")
 )