RES-1633 unapproved events #598
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…vents # Conflicts: # app/Http/Controllers/API/NetworkController.php
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
|
SonarCloud Quality Gate failed.
|
# Conflicts: # tests/Feature/Events/ExportTest.php
ngm
reviewed
Feb 20, 2023
ngm
reviewed
Feb 20, 2023
There was a problem hiding this comment.
In general, it adds a method for checking whether a user can see an event based on event and group approval. And then amends Calendar, Export, and Search to take this into account.
- Added in a permission check for Calendar Events, which seems good.
- Wondered about ExportController::devices - one place it is called is https://therestartproject.org/download-dataset/ which is a public call - so I wondered if the permission check in userCanSeeEvent is added, whether this would then return no data here. But as discussed it will still be fine, as it will return devices from events where both the events and groups are approved.
- I get a 'Maximum execution time of 60 seconds exceeded' when trying http://restarters.test:8000/export/devices locally with the new code change - I guess the extra permission check slows it down? /export/devices completes if I run it off develop.
- Seems correct to filter Search::parties by userCanSeeEvent.
- approved is returned via the API, but events are not filtered dependent on approved. This is correct, as we let the client side decide what they want to do.
|
Kudos, SonarCloud Quality Gate passed!
|
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This builds on RES-1101, so the diffs will look wrong until that is merged.
Unapproved events (and devices of those events) should be visible to:
So:
userCanSeeEventmethod inUserto contain this logic.ExportController, add this logic and a new approved column into the export.Search, add this logic.approvedproperty in the API forPartyandPartySummary.EditWordpressPostForEventParty::ofTheseGroups.CalendarEventsControlleradd this logic and fix up the event status, including for cancelled events.