Give permission to see Allergies for Event to Responsible Group

Signed-off-by: Daniel Yang Hansen <daniel.yang.hansen@gmail.com>

lego/apps/events/models.py

@@ -32,7 +32,7 @@
 from lego.apps.followers.models import FollowEvent
 from lego.apps.permissions.models import ObjectPermissionsModel
 from lego.apps.users.constants import AUTUMN, SPRING
-from lego.apps.users.models import AbakusGroup, Penalty, User
+from lego.apps.users.models import AbakusGroup, Membership, Penalty, User
 from lego.utils.models import BasisModel
 from lego.utils.youtube_validator import youtube_validator
 
@@ -134,6 +134,15 @@ def user_should_see_regs(self, user: User) -> bool:
             or (self.created_by is not None and self.created_by.id == user.id)
         )
 
+    def user_should_see_allergies(self, user: User) -> bool:
+        memberships = Membership.objects.filter(user=user)
+        in_responsible_group = self.responsible_group in [
+            mem.abakus_group for mem in memberships
+        ]
+        created_by_self = user == self.created_by
+
+        return created_by_self or in_responsible_group
+
     def admin_register(
         self,
         admin_user: User,

lego/apps/events/serializers/events.py

@@ -327,6 +327,9 @@ class EventAdministrateSerializer(EventReadSerializer):
     pools = PoolAdministrateSerializer(many=True)
     unregistered = RegistrationReadDetailedSerializer(many=True)
     waiting_registrations = RegistrationReadDetailedSerializer(many=True)
+    responsible_group = AbakusGroupField(
+        queryset=AbakusGroup.objects.all(), required=False, allow_null=True
+    )
 
     class Meta(EventReadSerializer.Meta):
         fields = EventReadSerializer.Meta.fields + (  # type: ignore
@@ -337,6 +340,7 @@ class Meta(EventReadSerializer.Meta):
             "use_contact_tracing",
             "created_by",
             "feedback_required",
+            "responsible_group",
         )
 
 

lego/apps/events/views.py

@@ -251,8 +251,7 @@ def allergies(self, request, *args, **kwargs):
         event_id = self.kwargs.get("pk", None)
         serializer = EventAdministrateSerializer
         event = Event.objects.get(pk=event_id)
-
-        if request.user == event.created_by:
+        if event.user_should_see_allergies(request.user):
             serializer = EventAdministrateAllergiesSerializer
 
         event_data = serializer(event).data