Better permission for /api/counter/search/detailed

counter/api.py

@@ -22,7 +22,7 @@ from ninja_extra.pagination import PageNumberPaginationExtra
 from ninja_extra.schemas import PaginatedResponseSchema
 
 from api.auth import ApiKeyAuth
-from api.permissions import CanAccessLookup, CanView, IsInGroup, IsRoot
+from api.permissions import CanAccessLookup, CanView, HasPerm, IsInGroup, IsRoot
 from counter.models import Counter, Product, ProductType
 from counter.schemas import (
     CounterFilterSchema,
@@ -93,7 +93,7 @@ class ProductController(ControllerBase):
     @route.get(
         "/search/detailed",
         response=PaginatedResponseSchema[ProductSchema],
-        permissions=[IsCounterAdmin],
+        permissions=[HasPerm("counter.view_product")],
         url_name="search_products_detailed",
     )
     @paginate(PageNumberPaginationExtra, page_size=50)

counter/templates/counter/product_form.jinja

@@ -83,6 +83,7 @@
 {% endmacro %}
 
 {% block content %}
+  {% if not user.has_perm("counter.change_product") %}
     <div class="alert alert-yellow">
       <div class="alert-main">
         {%- trans trimmed -%}
@@ -92,6 +93,7 @@
         {%- endtrans -%}
       </div>
     </div>
+  {% endif %}
   {% if object %}
     <h2>{{ object }}</h2>
     <p><i>{% trans %}Creation date{% endtrans %} : {{ object.created_at|date }}</i></p>

counter/views/admin.py

@@ -181,6 +181,9 @@ class ProductEditView(CounterAdminTabsMixin, PermissionRequiredMixin, UpdateView
     permission_required = "counter.change_product"
 
     def has_permission(self):
+        # If users can see products but not edit them,
+        # still show them this form, as it is the place where all infos are,
+        # but forbid to save it.
         return self.request.user.has_perm("counter.change_product") or (
             self.request.method == "GET"
             and self.request.user.has_perm("counter.view_product")