Merge pull request #1489 from ae-utbm/refill-perm

Refill perm

counter/models.py

@@ -669,13 +669,18 @@ class Counter(models.Model):
         """Update the barman activity to prevent timeout."""
         self.permanencies.filter(end=None).update(activity=timezone.now())
 
+    @cached_property
     def can_refill(self) -> bool:
-        """Show if the counter authorize the refilling with physic money."""
-        if self.type != "BAR":
-            return False
-        # at least one of the barmen is in the AE board
-        ae = Club.objects.get(id=settings.SITH_MAIN_CLUB_ID)
-        return any(ae.get_membership_for(barman) for barman in self.barmen_list)
+        """Show if the counter authorize the refilling with physic money.
+
+        Refills are authorized if a user having the required permission
+        is currently logged in.
+        """
+        return self.type == "BAR" and (
+            User.objects.with_perm("counter.add_refilling")
+            .filter(id__in=[u.id for u in self.barmen_list])
+            .exists()
+        )
 
     def get_top_barmen(self) -> QuerySet:
         """Return a QuerySet querying the office hours stats of all the barmen of all time

counter/tests/test_counter.py

@@ -108,6 +108,13 @@ class TestFullClickBase(TestCase):
 
 
 class TestRefilling(TestFullClickBase):
+    @classmethod
+    def setUpTestData(cls):
+        super().setUpTestData()
+        cls.board_admin.user_permissions.add(
+            Permission.objects.get(codename="add_refilling")
+        )
+
     def login_in_bar(self, barmen: User | None = None):
         used_barman = barmen if barmen is not None else self.board_admin
         self.client.post(
@@ -147,7 +154,7 @@ class TestRefilling(TestFullClickBase):
         assert self.updated_amount(self.customer) == 0
 
     def test_refilling_no_refer_fail(self):
-        """Check that the refill fails is the HTTP_REFERER header is missing"""
+        """Check that the refill fails if the HTTP_REFERER header is missing"""
 
         def refill():
             return self.client.post(

counter/views/click.py

@@ -204,7 +204,7 @@ class CounterClick(
             res["student_card_fragment"] = StudentCardFormFragment.as_fragment()(
                 self.request, customer=self.customer
             )
-        if self.object.can_refill():
+        if self.object.can_refill:
             res["refilling_fragment"] = RefillingCreateView.as_fragment()(
                 self.request, customer=self.customer, counter=self.object
             )
@@ -250,7 +250,7 @@ class RefillingCreateView(FragmentMixin, CreateView):
         if not (
             request.barmen
             and request.barmen.issubset(self.counter.barmen_list)
-            and self.counter.can_refill()
+            and self.counter.can_refill
         ):
             raise PermissionDenied