Changeset 6927

Timestamp:

23 Oct 2011, 18:30:07 (13 years ago)

Author:

Henrik Bettermann

Message:

Clearance ACs (and also upcoming school fee ACs) might have been purchased online. Thus we need an AC owner attribute which has to be checked before clearance is being started.

Location:

main/waeup.sirp/trunk/src/waeup/sirp

Files:

• accesscodes/accesscode.py (modified) (6 diffs)
• accesscodes/interfaces.py (modified) (1 diff)
• students/browser.py (modified) (1 diff)
• students/tests/test_browser.py (modified) (2 diffs)

main/waeup.sirp/trunk/src/waeup/sirp/accesscodes/accesscode.py

@@ -67 +67 @@
         self.batch_serial = batch_serial
         self.random_num = random_num
+        self.owner = None
         IWorkflowInfo(self).fireTransition('init')
 
@@ -419 +420 @@
     return code
 
-def fire_transition(access_code, arg, toward=False, comment=None):
+def fire_transition(access_code, arg, toward=False, comment=None, owner=None):
     """Fire workflow transition for access code.
 
@@ -437 +438 @@
     history of the changed access code. You can use this to place
     remarks like for which object the access code was used or similar.
+
+    If `owner` is specified, the owner attribute of the access code is checked.
+    If the owner is different :func:`fire_transition` fails and returns False.
 
     :func:`fire_transition` might raise exceptions depending on the
@@ -469 +473 @@
         raise KeyError(
             'No site available for looking up accesscodes')
+    if owner:
+        ac_owner = getattr(ac, 'owner', None)
+        if ac_owner and ac_owner != owner:
+            return False
     info = IWorkflowInfo(ac)
     if toward:
@@ -476 +484 @@
     return True
 
-def invalidate_accesscode(access_code, comment=None):
+def invalidate_accesscode(access_code, comment=None, owner=None):
     """Invalidate AccessCode denoted by string ``access_code``.
 
@@ -488 +496 @@
     """
     try:
-        fire_transition(access_code, 'use', comment=comment)
-        return True
+        return fire_transition(access_code, 'use', comment=comment, owner=owner)
     except:
         return False

main/waeup.sirp/trunk/src/waeup/sirp/accesscodes/interfaces.py

@@ -29 +29 @@
     representation = schema.TextLine(
         title = u'Complete title of access code',
+        )
+    owner = schema.TextLine(
+        title = u'Purchaser',
         )
     history = schema.Text(

main/waeup.sirp/trunk/src/waeup/sirp/students/browser.py

@@ -1066 +1066 @@
             comment = u"AC invalidated for %s" % self.context.student_id
             # Here we know that the ac is in state initialized so we do not
-            # expect an exception
-            invalidate_accesscode(pin,comment)
+            # expect an exception, but the owner might be different
+            if not invalidate_accesscode(pin,comment,self.context.student_id):
+                self.flash('You are not the owner of this access code.')
+                return
             self.context.clr_code = pin
         IWorkflowInfo(self.context).fireTransition('start_clearance')

main/waeup.sirp/trunk/src/waeup/sirp/students/tests/test_browser.py

@@ -124 +124 @@
             datetime.now(), 'some_userid', 'CLR', 9.99, 5)
         pins = pin_container[pin_container.keys()[0]].values()
-        self.clrpins = [x.representation for x in pins]
-        self.existing_clrpin = self.clrpins[0]
-        self.existing_clrpin
+        pins[0].owner = u'Hans Wurst'
+        self.existing_clrac = pins[0]
+        self.existing_clrpin = pins[0].representation
         parts = self.existing_clrpin.split('-')[1:]
         self.existing_clrseries, self.existing_clrnumber = parts
@@ -584 +584 @@
         self.browser.getControl(name="ac_series").value = self.existing_clrseries
         self.browser.getControl(name="ac_number").value = self.existing_clrnumber
+        # Owner is Hans Wurst, AC can't be invalidated
+        self.browser.getControl("Start clearance now").click()
+        self.assertMatches('...You are not the owner of this access code...',
+                           self.browser.contents)
+        # Set the correct owner
+        self.existing_clrac.owner = self.student_id
         self.browser.getControl("Start clearance now").click()
         self.assertMatches('...Clearance process has been started...',