Checkin only requires login (no perms) and block users from editing other checkins at Django level

RIGS/migrations/0047_auto_20230517_0944.py

@@ -0,0 +1,41 @@
+# Generated by Django 3.2.19 on 2023-05-17 08:44
+
+from django.conf import settings
+from django.db import migrations, models
+import django.db.models.deletion
+
+
+def migrate_old_data(apps, schema_editor):
+    EventChecklist = apps.get_model('RIGS', 'EventChecklist')
+    EventCheckIn = apps.get_model('RIGS', 'EventCheckIn')
+    for ec in EventChecklist.objects.all():
+        for crew in ec.crew.all():
+            vehicle = ec.vehicles.get(driver=crew.crewmember) or None
+            EventCheckIn.objects.create(event=ec.event, person=crew.crewmember, role=crew.role, time=crew.start, end_time=crew.end, vehicle=vehicle.vehicle)
+
+
+def revert(apps, schema_editor):
+    apps.get_model('RIGS', 'EventCheckIn').objects.all().delete()
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('RIGS', '0046_create_powertests'),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='EventCheckIn',
+            fields=[
+                ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('time', models.DateTimeField()),
+                ('role', models.CharField(blank=True, max_length=50)),
+                ('vehicle', models.CharField(blank=True, max_length=100)),
+                ('end_time', models.DateTimeField(blank=True, null=True)),
+                ('event', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='crew', to='RIGS.event')),
+                ('person', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='checkins', to=settings.AUTH_USER_MODEL)),
+            ],
+        ),
+        migrations.RunPython(migrate_old_data, reverse_code=revert),
+    ]

RIGS/migrations/0048_auto_20230518_1256.py

@@ -1,29 +1,16 @@
-# Generated by Django 3.2.16 on 2023-05-10 17:23
+# Generated by Django 3.2.19 on 2023-05-18 11:56
 
 from django.conf import settings
 from django.db import migrations, models
 import django.db.models.deletion
 
-
 class Migration(migrations.Migration):
 
     dependencies = [
-        ('RIGS', '0046_create_powertests'),
+        ('RIGS', '0047_auto_20230517_0944'),
     ]
 
     operations = [
-        migrations.CreateModel(
-            name='EventCheckIn',
-            fields=[
-                ('id', models.AutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
-                ('time', models.DateTimeField()),
-                ('role', models.CharField(blank=True, max_length=50)),
-                ('vehicle', models.CharField(blank=True, max_length=100)),
-                ('end_time', models.DateTimeField(null=True)),
-                ('event', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='crew', to='RIGS.event')),
-                ('person', models.ForeignKey(on_delete=django.db.models.deletion.CASCADE, related_name='checkins', to=settings.AUTH_USER_MODEL)),
-            ],
-        ),
                 migrations.RemoveField(
             model_name='eventchecklistvehicle',
             name='checklist',
@@ -145,6 +132,21 @@ class Migration(migrations.Migration):
             name='power_mic',
             field=models.ForeignKey(blank=True, help_text='Who is the Power MIC?', null=True, on_delete=django.db.models.deletion.CASCADE, related_name='checklists', to=settings.AUTH_USER_MODEL, verbose_name='Power MIC'),
         ),
+        migrations.AlterField(
+            model_name='eventchecklist',
+            name='reviewed_at',
+            field=models.DateTimeField(blank=True, null=True),
+        ),
+        migrations.AlterField(
+            model_name='powertestrecord',
+            name='reviewed_at',
+            field=models.DateTimeField(blank=True, null=True),
+        ),
+        migrations.AlterField(
+            model_name='riskassessment',
+            name='reviewed_at',
+            field=models.DateTimeField(blank=True, null=True),
+        ),
         migrations.DeleteModel(
             name='EventChecklistCrew',
         ),

RIGS/models.py

@@ -711,17 +711,17 @@ def validate_url(value):
 
 
 class ReviewableModel(models.Model):
-    reviewed_at = models.DateTimeField(null=True)
+    reviewed_at = models.DateTimeField(null=True, blank=True)
     reviewed_by = models.ForeignKey(settings.AUTH_USER_MODEL, blank=True, null=True,
                                     verbose_name="Reviewer", on_delete=models.CASCADE)
 
+    class Meta:
+        abstract = True
+
     @cached_property
     def fieldz(self):
         return [n.name for n in list(self._meta.get_fields()) if n.name != 'reviewed_at' and n.name != 'reviewed_by' and not n.is_relation and not n.auto_created]
 
-    class Meta:
-        abstract = True
-
 
 @reversion.register
 class RiskAssessment(ReviewableModel, RevisionMixin):
@@ -821,6 +821,12 @@ class RiskAssessment(ReviewableModel, RevisionMixin):
     def get_event_size_display(self):
         return self.SIZES[self.event_size][1] + " Event"
 
+    def __str__(self):
+        return f"{self.pk} | {self.event}"
+
+    def get_absolute_url(self):
+        return reverse('ra_detail', kwargs={'pk': self.pk})
+
     @property
     def activity_feed_string(self):
         return str(self.event)
@@ -829,12 +835,6 @@ class RiskAssessment(ReviewableModel, RevisionMixin):
     def name(self):
         return str(self)
 
-    def get_absolute_url(self):
-        return reverse('ra_detail', kwargs={'pk': self.pk})
-
-    def __str__(self):
-        return f"{self.pk} | {self.event}"
-
 
 @reversion.register
 class EventChecklist(ReviewableModel, RevisionMixin):
@@ -862,6 +862,9 @@ class EventChecklist(ReviewableModel, RevisionMixin):
             ('review_eventchecklist', 'Can review Event Checklists')
         ]
 
+    def __str__(self):
+        return f"{self.pk} - {self.event}"
+
     @property
     def activity_feed_string(self):
         return str(self.event)
@@ -869,9 +872,6 @@ class EventChecklist(ReviewableModel, RevisionMixin):
     def get_absolute_url(self):
         return reverse('ec_detail', kwargs={'pk': self.pk})
 
-    def __str__(self):
-        return f"{self.pk} - {self.event}"
-
 
 @reversion.register
 class PowerTestRecord(ReviewableModel, RevisionMixin):
@@ -915,6 +915,12 @@ class PowerTestRecord(ReviewableModel, RevisionMixin):
     all_rcds_tested = models.BooleanField(blank=True, null=True, help_text="All circuit RCDs tested?<br><small>(using test button)</small>")
     public_sockets_tested = models.BooleanField(blank=True, null=True, help_text="Public/Performer accessible circuits tested?<br><small>(using socket tester)</small>")
 
+    class Meta:
+        ordering = ['event']
+        permissions = [
+            ('review_power', 'Can review Power Test Records')
+        ]
+
     def __str__(self):
         return f"{self.pk} - {self.event}"
 
@@ -922,12 +928,6 @@ class PowerTestRecord(ReviewableModel, RevisionMixin):
     def activity_feed_string(self):
         return str(self.event)
 
-    class Meta:
-        ordering = ['event']
-        permissions = [
-            ('review_power', 'Can review Power Test Records')
-        ]
-
 
 class EventCheckIn(models.Model):
     event = models.ForeignKey('Event', related_name='crew', on_delete=models.CASCADE)
@@ -935,7 +935,10 @@ class EventCheckIn(models.Model):
     time = models.DateTimeField()
     role = models.CharField(max_length=50, blank=True)
     vehicle = models.CharField(max_length=100, blank=True)
-    end_time = models.DateTimeField(null=True)
+    end_time = models.DateTimeField(null=True, blank=True)
+
+    def __str__(self):
+        return f"{self.person} on {self.event}"
 
     def clean(self):
         sass = " Please invent time travel and retry."
@@ -944,11 +947,8 @@ class EventCheckIn(models.Model):
         if self.end_time and self.end_time < self.time:
             raise ValidationError("May not check out before you've checked in." + sass)
 
+    def get_absolute_url(self):
+        return reverse('event_detail', kwargs={'pk': self.event_id})
+
     def active(self):
         return end_time is not None
-
-    def get_absolute_url(self):
-        return reverse('event_detail', kwargs={'pk': self.event.pk})
-
-    def __str__(self):
-        return f"{self.person} on {self.event}"

RIGS/urls.py

@@ -101,13 +101,13 @@ urlpatterns = [
     path('event/power/<int:pk>/review/', permission_required_with_403('RIGS.review_power')(views.MarkReviewed.as_view()),
          name='pt_review', kwargs={'model': 'PowerTestRecord'}),
 
-    path('event/<int:pk>/checkin/', permission_required_with_403('RIGS.add_eventcheckin')(views.EventCheckIn.as_view()),
+    path('event/<int:pk>/checkin/', login_required(views.EventCheckIn.as_view()),
          name='event_checkin'),
-    path('event/checkout/', permission_required_with_403('RIGS.change_eventcheckin')(views.EventCheckOut.as_view()),
+    path('event/checkout/', login_required(views.EventCheckOut.as_view()),
          name='event_checkout'),
-    path('event/<int:pk>/checkin/edit/', permission_required_with_403('RIGS.change_eventcheckin')(views.EventCheckInEdit.as_view()),
+    path('event/<int:pk>/checkin/edit/', login_required(views.EventCheckInEdit.as_view()),
          name='edit_checkin'),
-    path('event/<int:pk>/checkin/add/', permission_required_with_403('RIGS.add_eventcheckin')(views.EventCheckInOverride.as_view()),
+    path('event/<int:pk>/checkin/add/', login_required(views.EventCheckInOverride.as_view()),
          name='event_checkin_override'),
 
     # Finance

RIGS/views/hs.py

@@ -1,7 +1,7 @@
 from django.apps import apps
 from django.contrib import messages
 from django.http import HttpResponseRedirect
-from django.urls import reverse_lazy
+from django.urls import reverse
 from django.utils import timezone
 from django.views import generic
 from reversion import revisions as reversion
@@ -37,7 +37,7 @@ class MarkReviewed(generic.View):
             obj.reviewed_by = self.request.user
             obj.reviewed_at = timezone.now()
             obj.save()
-        return HttpResponseRedirect(reverse_lazy('hs_list'))
+        return HttpResponseRedirect(reverse('hs_list'))
 
 
 class EventRiskAssessmentCreate(HSCreateView):
@@ -53,12 +53,12 @@ class EventRiskAssessmentCreate(HSCreateView):
         ra = models.RiskAssessment.objects.filter(event=event).first()
 
         if ra is not None:
-            return HttpResponseRedirect(reverse_lazy('ra_edit', kwargs={'pk': ra.pk}))
+            return HttpResponseRedirect(reverse('ra_edit', kwargs={'pk': ra.pk}))
 
         return super(EventRiskAssessmentCreate, self).get(self)
 
     def get_success_url(self):
-        return reverse_lazy('ra_detail', kwargs={'pk': self.object.pk})
+        return reverse('ra_detail', kwargs={'pk': self.object.pk})
 
 
 class EventRiskAssessmentEdit(generic.UpdateView):
@@ -71,7 +71,7 @@ class EventRiskAssessmentEdit(generic.UpdateView):
         ra.reviewed_by = None
         ra.reviewed_at = None
         ra.save()
-        return reverse_lazy('ra_detail', kwargs={'pk': self.object.pk})
+        return reverse('ra_detail', kwargs={'pk': self.object.pk})
 
     def get_context_data(self, **kwargs):
         context = super(EventRiskAssessmentEdit, self).get_context_data(**kwargs)
@@ -114,7 +114,7 @@ class EventChecklistEdit(generic.UpdateView):
         ec.reviewed_by = None
         ec.reviewed_at = None
         ec.save()
-        return reverse_lazy('ec_detail', kwargs={'pk': self.object.pk})
+        return reverse('ec_detail', kwargs={'pk': self.object.pk})
 
     def get_context_data(self, **kwargs):
         context = super(EventChecklistEdit, self).get_context_data(**kwargs)
@@ -142,12 +142,12 @@ class EventChecklistCreate(HSCreateView):
 
         if ra is None:
             messages.error(self.request, f'A Risk Assessment must exist prior to creating any Event Checklists for {event}! Please create one now.')
-            return HttpResponseRedirect(reverse_lazy('event_ra', kwargs={'pk': epk}))
+            return HttpResponseRedirect(reverse('event_ra', kwargs={'pk': epk}))
 
         return super(EventChecklistCreate, self).get(self)
 
     def get_success_url(self):
-        return reverse_lazy('ec_detail', kwargs={'pk': self.object.pk})
+        return reverse('ec_detail', kwargs={'pk': self.object.pk})
 
 
 class PowerTestDetail(generic.DetailView):
@@ -170,7 +170,7 @@ class PowerTestEdit(generic.UpdateView):
         ec.reviewed_by = None
         ec.reviewed_at = None
         ec.save()
-        return reverse_lazy('ec_detail', kwargs={'pk': self.object.pk})
+        return reverse('ec_detail', kwargs={'pk': self.object.pk})
 
     def get_context_data(self, **kwargs):
         context = super().get_context_data(**kwargs)
@@ -197,12 +197,12 @@ class PowerTestCreate(HSCreateView):
 
         if ra is None:
             messages.error(self.request, f'A Risk Assessment must exist prior to creating any Power Test Records for {event}! Please create one now.')
-            return HttpResponseRedirect(reverse_lazy('event_ra', kwargs={'pk': epk}))
+            return HttpResponseRedirect(reverse('event_ra', kwargs={'pk': epk}))
 
         return super().get(self)
 
     def get_success_url(self):
-        return reverse_lazy('pt_detail', kwargs={'pk': self.object.pk})
+        return reverse('pt_detail', kwargs={'pk': self.object.pk})
 
 
 class HSList(generic.ListView):
@@ -263,6 +263,12 @@ class EventCheckInEdit(generic.UpdateView, ModalURLMixin):
     template_name = 'hs/eventcheckin_form.html'
     form_class = forms.EditCheckInForm
 
+    def dispatch(self, request, *args, **kwargs):
+        obj = self.get_object()
+        if not obj.person == self.request.user and not obj.event.mic == self.request.user:
+            return redirect(self.request.META.get('HTTP_REFERER', '/'))
+        return super().dispatch(request)
+
     def get_success_url(self):
         return self.get_close_url('event_detail', 'event_detail')  # Well, that's one way of doing that...!