Docker/AdventureLog
Docker/AdventureLog
1
0
Fork 0
mirror of https://github.com/seanmorley15/AdventureLog.git synced 2025-07-19 12:59:36 +02:00
Code Issues Releases Activity

Fixes [BUG] Cannot change a adventure from Private to Public #617

Browse source
This commit is contained in:
Sean Morley 2025-05-19 11:21:40 -04:00
parent 9435ccfa5a
commit d87d0e807f
2 changed files with 17 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

22
backend/server/adventures/views/adventure_view.py
View file

@ -10,6 +10,7 @@ from adventures.models import Adventure, Category, Transportation, Lodging
from adventures.permissions import IsOwnerOrSharedWithFullAccess from adventures.permissions import IsOwnerOrSharedWithFullAccess
from adventures.serializers import AdventureSerializer, TransportationSerializer, LodgingSerializer from adventures.serializers import AdventureSerializer, TransportationSerializer, LodgingSerializer
from adventures.utils import pagination from adventures.utils import pagination
from django.contrib.auth.models import AnonymousUser
import requests import requests
class AdventureViewSet(viewsets.ModelViewSet): class AdventureViewSet(viewsets.ModelViewSet):
@ -60,14 +61,15 @@ class AdventureViewSet(viewsets.ModelViewSet):
""" """
user = self.request.user user = self.request.user
# Actions that allow public access (include 'retrieve' and your custom action)
public_allowed_actions = {'retrieve', 'additional_info'}
if not user.is_authenticated: if not user.is_authenticated:
# Unauthenticated users can only access public adventures for retrieval if self.action in public_allowed_actions:
if self.action == 'retrieve':
return Adventure.objects.retrieve_adventures(user, include_public=True).order_by('-updated_at') return Adventure.objects.retrieve_adventures(user, include_public=True).order_by('-updated_at')
return Adventure.objects.none() return Adventure.objects.none()
# Authenticated users: Handle retrieval separately include_public = self.action in public_allowed_actions
include_public = self.action == 'retrieve'
return Adventure.objects.retrieve_adventures( return Adventure.objects.retrieve_adventures(
user, user,
include_public=include_public, include_public=include_public,
@ -75,6 +77,7 @@ class AdventureViewSet(viewsets.ModelViewSet):
include_shared=True include_shared=True
).order_by('-updated_at') ).order_by('-updated_at')
def perform_update(self, serializer): def perform_update(self, serializer):
adventure = serializer.save() adventure = serializer.save()
if adventure.collection: if adventure.collection:
@ -175,9 +178,13 @@ class AdventureViewSet(viewsets.ModelViewSet):
def additional_info(self, request, pk=None): def additional_info(self, request, pk=None):
adventure = self.get_object() adventure = self.get_object()
# Permission check: owner or shared collection member user = request.user
if adventure.user_id != request.user:
if not (adventure.collection and adventure.collection.shared_with.filter(id=request.user.id).exists()): # Allow if public
if not adventure.is_public:
# Only allow owner or shared collection members
if not user.is_authenticated or adventure.user_id != user:
if not (adventure.collection and adventure.collection.shared_with.filter(uuid=user.uuid).exists()):
return Response({"error": "User does not have permission to access this adventure"}, return Response({"error": "User does not have permission to access this adventure"},
status=status.HTTP_403_FORBIDDEN) status=status.HTTP_403_FORBIDDEN)
@ -203,6 +210,5 @@ class AdventureViewSet(viewsets.ModelViewSet):
"sunset": results.get('sunset') "sunset": results.get('sunset')
}) })
response_data['sun_times'] = sun_times response_data['sun_times'] = sun_times
return Response(response_data) return Response(response_data)

2
frontend/src/lib/components/AdventureModal.svelte
View file

@ -607,7 +607,7 @@
<p class="text-red-500">{wikiError}</p> <p class="text-red-500">{wikiError}</p>
</div> </div>
</div> </div>
{#if !collection?.id} {#if !adventure?.collection}
<div> <div>
<div class="form-control flex items-start mt-1"> <div class="form-control flex items-start mt-1">
<label class="label cursor-pointer flex items-start space-x-2"> <label class="label cursor-pointer flex items-start space-x-2">