diff --git a/ereuse_devicehub/resources/device/views.py b/ereuse_devicehub/resources/device/views.py index f4bfc960..916c5ec6 100644 --- a/ereuse_devicehub/resources/device/views.py +++ b/ereuse_devicehub/resources/device/views.py @@ -156,7 +156,7 @@ class DeviceView(View): return query.filter(*args['filter']).order_by(*args['sort']) - def user_filter(self, query): + def visibility_filter(self, query): filterqs = request.args.get('filter', None) if (filterqs and 'lot' not in filterqs): diff --git a/ereuse_devicehub/resources/lot/views.py b/ereuse_devicehub/resources/lot/views.py index 3590ba49..b0741e32 100644 --- a/ereuse_devicehub/resources/lot/views.py +++ b/ereuse_devicehub/resources/lot/views.py @@ -6,16 +6,19 @@ from typing import Dict, List, Set, Union import marshmallow as ma import teal.cache -from flask import Response, jsonify, request +from flask import Response, jsonify, request, g from marshmallow import Schema as MarshmallowSchema, fields as f from teal.marshmallow import EnumField from teal.resource import View +from sqlalchemy import or_ from sqlalchemy.orm import joinedload +from ereuse_devicehub import auth from ereuse_devicehub.db import db from ereuse_devicehub.query import things_response from ereuse_devicehub.resources.device.models import Device, Computer from ereuse_devicehub.resources.lot.models import Lot, Path +from ereuse_devicehub.resources.deliverynote.models import Deliverynote class LotFormat(Enum): @@ -85,6 +88,7 @@ class LotView(View): } else: query = Lot.query + query = self.visibility_filter(query) if args['search']: query = query.filter(Lot.name.ilike(args['search'] + '%')) lots = query.paginate(per_page=6 if args['search'] else 30) @@ -94,6 +98,13 @@ class LotView(View): ) return jsonify(ret) + def visibility_filter(self, query): + query = query.outerjoin(Deliverynote) \ + .filter(or_(Deliverynote.receiver_address == g.user.email, + Deliverynote.supplier_email == g.user.email, + Lot.owner_id == g.user.id)) + return query + def delete(self, id): lot = Lot.query.filter_by(id=id).one() lot.delete()