Repository: fossasia/open-event-server

Issue:
Disconnected role invites and actual role
There's a problem in permissions system. In dashboard, it shows role invites and in backend it uses UserEventRoles so if you edit a role in dashboard, it changes nothing in the backend. No idea why these 2 are different things but you are still a co-organizer in backend


Discussion:
Either backend should disallow editing role invites because it is confusing, or update actual roles when edited
Can I work on this issue?
Go ahead. We have decided to remove the option of editing role invite
And what about deleting role invite? Similar to editing, deleting accepted role-invite should either be reflected in UserEventRoles, or deletion should also not be allowed.
Deleting accepted role invite shouldn't be possible I think. Logically, an invite can only be deleted before it is accepted.
Unless there is some kind of unique constraint which disallows sending the invite again
As of now, organizer can delete accepted role invite(although no email is being sent to the user, to inform about this deletion). So, I need to make changes so that it is not possible to delete accepted role invite.
But shouldn't there be functionality to allow organizers to delete any assigned role to other user, not using role-invites model, but other model(UserEventRoles)?
Yes


Resolving patch:
diff --git a/app/api/role_invites.py b/app/api/role_invites.py
--- a/app/api/role_invites.py
+++ b/app/api/role_invites.py
@@ -4,7 +4,7 @@
 
 from app.api.bootstrap import api
 from app.api.helpers.db import save_to_db
-from app.api.helpers.errors import ForbiddenError, NotFoundError, UnprocessableEntityError
+from app.api.helpers.errors import ConflictError, ForbiddenError, NotFoundError
 from app.api.helpers.mail import send_email_role_invite, send_user_email_role_invite
 from app.api.helpers.notification import send_notif_event_role
 from app.api.helpers.permission_manager import has_access
@@ -119,47 +119,19 @@ class RoleInviteDetail(ResourceDetail):
     Role invite detail by id
     """
 
-    def before_update_object(self, role_invite, data, view_kwargs):
+    def before_delete_object(self, role_invite, view_kwargs):
         """
-        Method to edit object
-        :param role_invite:
-        :param data:
+        method to check for proper permissions for deleting
+        :param order:
         :param view_kwargs:
         :return:
         """
-        user = User.query.filter_by(email=role_invite.email).first()
-        if user:
-            if not has_access(
-                'is_organizer', event_id=role_invite.event_id
-            ) and not has_access('is_user_itself', user_id=user.id):
-                raise UnprocessableEntityError(
-                    {'source': ''},
-                    "Status can be updated only by event organizer or user hiself",
-                )
-        if (
-            'role_name' in data
-            and data['role_name'] == 'owner'
-            and not has_access('is_owner', event_id=data['event'])
-        ):
-            raise ForbiddenError({'source': ''}, 'Owner access is required.')
-        if not user and not has_access('is_organizer', event_id=role_invite.event_id):
-            raise UnprocessableEntityError({'source': ''}, "User not registered")
-        if not has_access('is_organizer', event_id=role_invite.event_id) and (
-            len(list(data.keys())) > 1 or 'status' not in data
-        ):
-            raise UnprocessableEntityError(
-                {'source': ''}, "You can only change your status"
+        if role_invite.status == 'accepted':
+            raise ConflictError(
+                {'pointer': '/data/status'}, 'You cannot delete an accepted role invite.'
             )
-        if data.get('deleted_at'):
-            if role_invite.role_name == 'owner' and not has_access(
-                'is_owner', event_id=role_invite.event_id
-            ):
-                raise ForbiddenError({'source': ''}, 'Owner access is required.')
-            if role_invite.role_name != 'owner' and not has_access(
-                'is_organizer', event_id=role_invite.event_id
-            ):
-                raise ForbiddenError({'source': ''}, 'Organizer access is required.')
 
+    methods = ['GET', 'DELETE']
     decorators = (
         api.has_permission(
             'is_organizer',
@@ -173,7 +145,7 @@ def before_update_object(self, role_invite, data, view_kwargs):
     data_layer = {
         'session': db.session,
         'model': RoleInvite,
-        'methods': {'before_update_object': before_update_object},
+        'methods': {'before_delete_object': before_delete_object},
     }
 
 


Test patch:
diff --git a/tests/hook_main.py b/tests/hook_main.py
--- a/tests/hook_main.py
+++ b/tests/hook_main.py
@@ -3394,18 +3394,6 @@ def role_invite_get_detail(transaction):
         db.session.commit()
 
 
-@hooks.before("Role Invites > Role Invite Details > Update Role Invite")
-def role_invite_patch(transaction):
-    """
-    PATCH /role-invites/1
-    :param transaction:
-    :return:
-    """
-    with stash['app'].app_context():
-        RoleInviteFactory()
-        db.session.commit()
-
-
 @hooks.before("Role Invites > Role Invite Details > Delete Role Invite")
 def role_invite_delete(transaction):
     """