320 lines
11 KiB
Python
320 lines
11 KiB
Python
from typing import Any
|
|
|
|
from fastapi import APIRouter, HTTPException, status
|
|
from sqlmodel import func, select
|
|
|
|
from app.api.deps import CurrentUser, SessionDep
|
|
from app.models.base import (
|
|
ApiTags,
|
|
Message,
|
|
RowId,
|
|
)
|
|
from app.models.event import (
|
|
Event,
|
|
EventCreate,
|
|
EventPublic,
|
|
EventsPublic,
|
|
EventUpdate,
|
|
EventUserLink,
|
|
EventUserLinkCreate,
|
|
EventUserLinkUpdate,
|
|
EventUserLinkPublic,
|
|
EventUserLinksPublic,
|
|
)
|
|
from app.models.user import (
|
|
PermissionModule,
|
|
PermissionPart,
|
|
PermissionRight,
|
|
User,
|
|
)
|
|
|
|
router = APIRouter(prefix="/events", tags=[ApiTags.EVENTS])
|
|
|
|
# region # Events ##############################################################
|
|
|
|
|
|
@router.get("/", response_model=EventsPublic)
|
|
def read_events(
|
|
session: SessionDep, current_user: CurrentUser, skip: int = 0, limit: int = 100
|
|
) -> Any:
|
|
"""
|
|
Retrieve events.
|
|
"""
|
|
|
|
if current_user.has_permissions(
|
|
module=PermissionModule.EVENT,
|
|
part=PermissionPart.ADMIN,
|
|
rights=PermissionRight.READ,
|
|
):
|
|
count_statement = select(func.count()).select_from(Event)
|
|
count = session.exec(count_statement).one()
|
|
statement = select(Event).offset(skip).limit(limit)
|
|
events = session.exec(statement).all()
|
|
else:
|
|
count_statement = (
|
|
select(func.count())
|
|
.select_from(Event)
|
|
.join(EventUserLink) # Join with EventUserLink to check user permissions
|
|
.where(
|
|
EventUserLink.user_id == current_user.id,
|
|
# FIXME: (EventUserLink.rights & PermissionRight.READ) == PermissionRight.READ,
|
|
)
|
|
)
|
|
count = session.exec(count_statement).one()
|
|
statement = (
|
|
select(Event)
|
|
.join(EventUserLink) # Join with EventUserLink to check user permissions
|
|
.where(
|
|
EventUserLink.user_id == current_user.id,
|
|
# FIXME: (EventUserLink.rights & PermissionRight.READ) == PermissionRight.READ,
|
|
)
|
|
.offset(skip)
|
|
.limit(limit)
|
|
)
|
|
events = session.exec(statement).all()
|
|
|
|
return EventsPublic(data=events, count=count)
|
|
|
|
|
|
@router.get("/{id}", response_model=EventPublic)
|
|
def read_event(session: SessionDep, current_user: CurrentUser, id: RowId) -> Any:
|
|
"""
|
|
Get event by ID.
|
|
"""
|
|
event = session.get(Event, id)
|
|
if not event:
|
|
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Event not found")
|
|
|
|
if not current_user.has_permissions(
|
|
module=PermissionModule.EVENT,
|
|
part=PermissionPart.ADMIN,
|
|
rights=PermissionRight.READ,
|
|
) and not (event.user_has_rights(user=current_user, rights=PermissionRight.READ)):
|
|
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Not enough permissions")
|
|
|
|
return event
|
|
|
|
|
|
@router.post("/", response_model=EventPublic)
|
|
def create_event(
|
|
*, session: SessionDep, current_user: CurrentUser, event_in: EventCreate
|
|
) -> Any:
|
|
"""
|
|
Create new event.
|
|
"""
|
|
if not current_user.has_permissions(
|
|
module=PermissionModule.EVENT,
|
|
part=PermissionPart.ADMIN,
|
|
rights=PermissionRight.CREATE,
|
|
):
|
|
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Not enough permissions")
|
|
|
|
event = Event.create(create_obj=event_in, session=session)
|
|
event.add_user(user=current_user, rights=PermissionRight.ADMIN, session=session)
|
|
return event
|
|
|
|
|
|
@router.put("/{id}", response_model=EventPublic)
|
|
def update_event(
|
|
*,
|
|
session: SessionDep,
|
|
current_user: CurrentUser,
|
|
id: RowId,
|
|
event_in: EventUpdate,
|
|
) -> Any:
|
|
"""
|
|
Update an event.
|
|
"""
|
|
event = session.get(Event, id)
|
|
if not event:
|
|
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Event not found")
|
|
|
|
if not current_user.has_permissions(
|
|
module=PermissionModule.EVENT,
|
|
part=PermissionPart.ADMIN,
|
|
rights=PermissionRight.UPDATE,
|
|
) and not (event.user_has_rights(user=current_user, rights=PermissionRight.UPDATE)):
|
|
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Not enough permissions")
|
|
|
|
return Event.update(db_obj=event, in_obj=event_in, session=session)
|
|
|
|
|
|
@router.delete("/{id}")
|
|
def delete_event(
|
|
session: SessionDep,
|
|
current_user: CurrentUser,
|
|
id: RowId,
|
|
) -> Message:
|
|
"""
|
|
Delete an event.
|
|
"""
|
|
event = session.get(Event, id)
|
|
if not event:
|
|
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Event not found")
|
|
|
|
if not current_user.has_permissions(
|
|
module=PermissionModule.EVENT,
|
|
part=PermissionPart.ADMIN,
|
|
rights=PermissionRight.DELETE,
|
|
) and not (event.user_has_rights(user=current_user, rights=PermissionRight.DELETE)):
|
|
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Not enough permissions")
|
|
|
|
session.delete(event)
|
|
session.commit()
|
|
return Message(message="Event deleted successfully")
|
|
|
|
|
|
# endregion
|
|
|
|
|
|
# region # Events / Users ######################################################
|
|
|
|
|
|
@router.get("/{event_id}/users/", response_model=EventUserLinksPublic)
|
|
def read_event_users(
|
|
session: SessionDep, current_user: CurrentUser, event_id: RowId, skip: int = 0, limit: int = 100
|
|
) -> Any:
|
|
"""
|
|
Retrieve all event users.
|
|
"""
|
|
|
|
event = session.get(Event, event_id)
|
|
if not event:
|
|
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Event not found")
|
|
|
|
if not current_user.has_permissions(
|
|
module=PermissionModule.EVENT,
|
|
part=PermissionPart.ADMIN,
|
|
rights=PermissionRight.MANAGE_USERS,
|
|
) and not (event.user_has_rights(user=current_user, rights=PermissionRight.MANAGE_USERS)):
|
|
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Not enough permissions")
|
|
|
|
count_statement = (select(func.count())
|
|
.select_from(EventUserLink)
|
|
.where(EventUserLink.event_id == event.id)
|
|
)
|
|
count = session.exec(count_statement).one()
|
|
statement = (select(EventUserLink)
|
|
.where(EventUserLink.event_id == event.id)
|
|
.offset(skip)
|
|
.limit(limit)
|
|
)
|
|
event_user_links = session.exec(statement).all()
|
|
|
|
return EventUserLinksPublic(data=event_user_links, count=count)
|
|
|
|
|
|
@router.post("/{event_id}/users/", tags=[ApiTags.USERS], response_model=EventUserLinkPublic)
|
|
def create_event_user(
|
|
session: SessionDep,
|
|
current_user: CurrentUser,
|
|
event_id: RowId,
|
|
user_in: EventUserLinkCreate,
|
|
) -> Any:
|
|
"""
|
|
Create a new link between a user and an event.
|
|
"""
|
|
|
|
if user_in.rights & ~PermissionRight.ADMIN:
|
|
# FIXME: find a proper richts checker
|
|
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Invalid permission rights")
|
|
|
|
event = session.get(Event, event_id)
|
|
if not event:
|
|
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Event not found")
|
|
|
|
if not current_user.has_permissions(
|
|
module=PermissionModule.EVENT,
|
|
part=PermissionPart.ADMIN,
|
|
rights=PermissionRight.MANAGE_USERS,
|
|
) and not (event.user_has_rights(user=current_user, rights=(PermissionRight.MANAGE_USERS | user_in.rights))):
|
|
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Not enough permissions")
|
|
|
|
user = session.get(User, user_in.user_id)
|
|
if not user:
|
|
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="User not found")
|
|
|
|
user_link = event.get_user_link(user)
|
|
if user_link:
|
|
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="User already part of this event")
|
|
|
|
return event.add_user(user=user, rights=user_in.rights, session=session)
|
|
|
|
|
|
@router.put("/{event_id}/users/{user_id}", tags=[ApiTags.USERS], response_model=EventUserLinkPublic)
|
|
def update_user_in_event(
|
|
session: SessionDep,
|
|
current_user: CurrentUser,
|
|
event_id: RowId,
|
|
user_id: RowId,
|
|
user_in: EventUserLinkUpdate,
|
|
) -> Any:
|
|
"""
|
|
Update a user link within an event.
|
|
"""
|
|
|
|
event = session.get(Event, event_id)
|
|
if not event:
|
|
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Event not found")
|
|
|
|
user = session.get(User, user_id)
|
|
if not user:
|
|
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="User not found")
|
|
|
|
valid_flags = sum(flag.value for flag in PermissionRight)
|
|
if user_in.rights & ~valid_flags:
|
|
# FIXME: find a proper richts checker
|
|
raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="Invalid permission rights")
|
|
|
|
if not current_user.has_permissions(
|
|
module=PermissionModule.EVENT,
|
|
part=PermissionPart.ADMIN,
|
|
rights=PermissionRight.MANAGE_USERS,
|
|
) and not (event.user_has_rights(user=current_user, rights=(PermissionRight.MANAGE_USERS | user_in.rights))):
|
|
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Not enough permissions")
|
|
|
|
user_link = event.get_user_link(user)
|
|
if not user_link:
|
|
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="User is not part of this event")
|
|
|
|
return event.update_user(user=user, rights=user_in.rights, session=session)
|
|
|
|
|
|
@router.delete("/{event_id}/users/{user_id}", tags=[ApiTags.USERS])
|
|
def remove_user_from_event(
|
|
session: SessionDep, current_user: CurrentUser, event_id: RowId, user_id: RowId
|
|
) -> Message:
|
|
"""
|
|
Remove a user link from an event.
|
|
"""
|
|
event = session.get(Event, event_id)
|
|
if not event:
|
|
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Event not found")
|
|
|
|
user = session.get(User, user_id)
|
|
if not user:
|
|
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="User not found")
|
|
|
|
if not current_user.has_permissions(
|
|
module=PermissionModule.EVENT,
|
|
part=PermissionPart.ADMIN,
|
|
rights=PermissionRight.MANAGE_USERS,
|
|
):
|
|
if current_user.id == user.id:
|
|
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Users are not allowed to delete themselves when they are not an super admin")
|
|
|
|
if not event.user_has_rights(user=current_user, rights=PermissionRight.MANAGE_USERS):
|
|
raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Not enough permissions")
|
|
|
|
user_link = event.get_user_link(user)
|
|
if not user_link:
|
|
raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="User is not part of this event")
|
|
|
|
event.remove_user(user=user, session=session)
|
|
return Message(
|
|
message="User removed successfully"
|
|
)
|
|
|
|
|
|
# endregion
|