Better permission for /api/counter/search/detailed

counter/api.py

@@ -22,7 +22,7 @@ from ninja_extra.pagination import PageNumberPaginationExtra
 from ninja_extra.schemas import PaginatedResponseSchema
 
 from api.auth import ApiKeyAuth
-from api.permissions import CanAccessLookup, CanView, IsInGroup, IsRoot
+from api.permissions import CanAccessLookup, CanView, HasPerm, IsInGroup, IsRoot
 from counter.models import Counter, Product, ProductType
 from counter.schemas import (
     CounterFilterSchema,
@@ -93,7 +93,7 @@ class ProductController(ControllerBase):
     @route.get(
         "/search/detailed",
         response=PaginatedResponseSchema[ProductSchema],
-        permissions=[IsCounterAdmin],
+        permissions=[HasPerm("counter.view_product")],
         url_name="search_products_detailed",
     )
     @paginate(PageNumberPaginationExtra, page_size=50)

counter/templates/counter/product_form.jinja

@@ -83,15 +83,17 @@
 {% endmacro %}
 
 {% block content %}
-  <div class="alert alert-yellow">
-    <div class="alert-main">
-      {%- trans trimmed -%}
-        You can see product details.
-        However, you cannot edit it, thus you won't be able
-        to submit this form.
-      {%- endtrans -%}
+  {% if not user.has_perm("counter.change_product") %}
+    <div class="alert alert-yellow">
+      <div class="alert-main">
+        {%- trans trimmed -%}
+          You can see product details.
+          However, you cannot edit it, thus you won't be able
+          to submit this form.
+        {%- endtrans -%}
+      </div>
     </div>
-  </div>
+  {% endif %}
   {% if object %}
     <h2>{{ object }}</h2>
     <p><i>{% trans %}Creation date{% endtrans %} : {{ object.created_at|date }}</i></p>

counter/views/admin.py

@@ -181,6 +181,9 @@ class ProductEditView(CounterAdminTabsMixin, PermissionRequiredMixin, UpdateView
     permission_required = "counter.change_product"
 
     def has_permission(self):
+        # If users can see products but not edit them,
+        # still show them this form, as it is the place where all infos are,
+        # but forbid to save it.
         return self.request.user.has_perm("counter.change_product") or (
             self.request.method == "GET"
             and self.request.user.has_perm("counter.view_product")