diff --git a/api/app/events/api.py b/api/app/events/api.py index 5ede09f36..901916c4a 100644 --- a/api/app/events/api.py +++ b/api/app/events/api.py @@ -245,8 +245,9 @@ def post(self): args = self.req_parser.parse_args() user_id = g.current_user["id"] + event_id = request.args['id'] current_user = user_repository.get_by_id(user_id) - if not current_user.is_admin: + if not (current_user.is_admin or current_user.is_event_response_viewer(event_id) or current_user.is_event_response_editor(event_id)): return FORBIDDEN if event_repository.exists_by_key(args['key']): diff --git a/api/app/users/models.py b/api/app/users/models.py index b19977735..94f19d28b 100644 --- a/api/app/users/models.py +++ b/api/app/users/models.py @@ -62,6 +62,7 @@ def __init__(self, self.deleted_datetime_utc = None self.verified_email = False self.agree_to_policy() + @property def full_name(self): @@ -103,7 +104,25 @@ def _has_admin_role(self, event_id, admin_role_name): return True return False + + def _has_read_only_role(self, event_id): + if self.event_roles is None: + return False + for event_role in self.event_roles: + if self.is_admin and event_role.event_id == event_id and (event_role.role == "read_only" or event_role.role == "response_viewer" or event_role.role == "response_editor"): + return True + + return False + def is_event_admin(self, event_id): + return self._has_admin_role(event_id, 'admin') + + def is_event_response_viewer(self, event_id): + return self._has_read_only_role(event_id, 'response_viewer') + + def is_event_response_editor(self, event_id): + return self._has_read_only_role(event_id, 'response_editor') + def is_event_admin(self, event_id): return self._has_admin_role(event_id, 'admin') diff --git a/webapp/src/App.js b/webapp/src/App.js index 0b97b5a0c..90785360d 100755 --- a/webapp/src/App.js +++ b/webapp/src/App.js @@ -22,7 +22,7 @@ import ReactGA from "react-ga"; import "./App.css"; import history from "./History"; -import { isEventAdmin, isRegistrationAdmin, isRegistrationVolunteer, isEventReviewer } from "./utils/user"; +import { isEventAdmin, isEventResponseViewerOnly, isEventResponseEditorOnly, isRegistrationAdmin, isRegistrationVolunteer, isEventReviewer } from "./utils/user"; import { withTranslation } from 'react-i18next'; import { userService } from "./services/user"; @@ -60,7 +60,9 @@ class EventNav extends Component { } id="eventNavbar">