From bd0621884b9c2a97b8edde2f662d9973fe355945 Mon Sep 17 00:00:00 2001
From: yiorgos marinellis <yiorgos@deevio.ai>
Date: Tue, 28 Apr 2020 22:33:33 +0200
Subject: [PATCH] Filter lots with owner id or deliverynote receiver or
 supplier

---
 ereuse_devicehub/resources/device/views.py |  2 +-
 ereuse_devicehub/resources/lot/views.py    | 13 ++++++++++++-
 2 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/ereuse_devicehub/resources/device/views.py b/ereuse_devicehub/resources/device/views.py
index f4bfc960..916c5ec6 100644
--- a/ereuse_devicehub/resources/device/views.py
+++ b/ereuse_devicehub/resources/device/views.py
@@ -156,7 +156,7 @@ class DeviceView(View):
         return query.filter(*args['filter']).order_by(*args['sort'])
 
 
-    def user_filter(self, query):
+    def visibility_filter(self, query):
         filterqs = request.args.get('filter', None)
         if (filterqs and
            'lot' not in filterqs):
diff --git a/ereuse_devicehub/resources/lot/views.py b/ereuse_devicehub/resources/lot/views.py
index 3590ba49..b0741e32 100644
--- a/ereuse_devicehub/resources/lot/views.py
+++ b/ereuse_devicehub/resources/lot/views.py
@@ -6,16 +6,19 @@ from typing import Dict, List, Set, Union
 
 import marshmallow as ma
 import teal.cache
-from flask import Response, jsonify, request
+from flask import Response, jsonify, request, g
 from marshmallow import Schema as MarshmallowSchema, fields as f
 from teal.marshmallow import EnumField
 from teal.resource import View
+from sqlalchemy import or_
 from sqlalchemy.orm import joinedload
 
+from ereuse_devicehub import auth
 from ereuse_devicehub.db import db
 from ereuse_devicehub.query import things_response
 from ereuse_devicehub.resources.device.models import Device, Computer
 from ereuse_devicehub.resources.lot.models import Lot, Path
+from ereuse_devicehub.resources.deliverynote.models import Deliverynote
 
 
 class LotFormat(Enum):
@@ -85,6 +88,7 @@ class LotView(View):
             }
         else:
             query = Lot.query
+            query = self.visibility_filter(query)
             if args['search']:
                 query = query.filter(Lot.name.ilike(args['search'] + '%'))
             lots = query.paginate(per_page=6 if args['search'] else 30)
@@ -94,6 +98,13 @@ class LotView(View):
             )
         return jsonify(ret)
 
+    def visibility_filter(self, query):
+        query = query.outerjoin(Deliverynote) \
+            .filter(or_(Deliverynote.receiver_address == g.user.email,
+                        Deliverynote.supplier_email == g.user.email,
+                        Lot.owner_id == g.user.id))
+        return query
+
     def delete(self, id):
         lot = Lot.query.filter_by(id=id).one()
         lot.delete()