obj_level_moderation added

backend/migrations/0002_auto_20180902_1716.py

+# Generated by Django 2.0.3 on 2018-09-02 15:16
+
+import backend.models.my_model.myModel
+import django.core.validators
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('backend', '0001_initial'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='campus',
+            name='obj_moderation_level',
+            field=models.SmallIntegerField(default=0, validators=[django.core.validators.MinValueValidator(0), backend.models.my_model.myModel.validate_obj_model_lv]),
+        ),
+        migrations.AlterField(
+            model_name='campustaggeditem',
+            name='obj_moderation_level',
+            field=models.SmallIntegerField(default=0, validators=[django.core.validators.MinValueValidator(0), backend.models.my_model.myModel.validate_obj_model_lv]),
+        ),
+        migrations.AlterField(
+            model_name='city',
+            name='obj_moderation_level',
+            field=models.SmallIntegerField(default=0, validators=[django.core.validators.MinValueValidator(0), backend.models.my_model.myModel.validate_obj_model_lv]),
+        ),
+        migrations.AlterField(
+            model_name='citytaggeditem',
+            name='obj_moderation_level',
+            field=models.SmallIntegerField(default=0, validators=[django.core.validators.MinValueValidator(0), backend.models.my_model.myModel.validate_obj_model_lv]),
+        ),
+        migrations.AlterField(
+            model_name='country',
+            name='obj_moderation_level',
+            field=models.SmallIntegerField(default=0, validators=[django.core.validators.MinValueValidator(0), backend.models.my_model.myModel.validate_obj_model_lv]),
+        ),
+        migrations.AlterField(
+            model_name='countrydri',
+            name='obj_moderation_level',
+            field=models.SmallIntegerField(default=0, validators=[django.core.validators.MinValueValidator(0), backend.models.my_model.myModel.validate_obj_model_lv]),
+        ),
+        migrations.AlterField(
+            model_name='countryscholarship',
+            name='obj_moderation_level',
+            field=models.SmallIntegerField(default=0, validators=[django.core.validators.MinValueValidator(0), backend.models.my_model.myModel.validate_obj_model_lv]),
+        ),
+        migrations.AlterField(
+            model_name='countrytaggeditem',
+            name='obj_moderation_level',
+            field=models.SmallIntegerField(default=0, validators=[django.core.validators.MinValueValidator(0), backend.models.my_model.myModel.validate_obj_model_lv]),
+        ),
+        migrations.AlterField(
+            model_name='currency',
+            name='obj_moderation_level',
+            field=models.SmallIntegerField(default=0, validators=[django.core.validators.MinValueValidator(0), backend.models.my_model.myModel.validate_obj_model_lv]),
+        ),
+        migrations.AlterField(
+            model_name='department',
+            name='obj_moderation_level',
+            field=models.SmallIntegerField(default=0, validators=[django.core.validators.MinValueValidator(0), backend.models.my_model.myModel.validate_obj_model_lv]),
+        ),
+        migrations.AlterField(
+            model_name='fortestingmoderation',
+            name='obj_moderation_level',
+            field=models.SmallIntegerField(default=0, validators=[django.core.validators.MinValueValidator(0), backend.models.my_model.myModel.validate_obj_model_lv]),
+        ),
+        migrations.AlterField(
+            model_name='fortestingversioning',
+            name='obj_moderation_level',
+            field=models.SmallIntegerField(default=0, validators=[django.core.validators.MinValueValidator(0), backend.models.my_model.myModel.validate_obj_model_lv]),
+        ),
+        migrations.AlterField(
+            model_name='offer',
+            name='obj_moderation_level',
+            field=models.SmallIntegerField(default=0, validators=[django.core.validators.MinValueValidator(0), backend.models.my_model.myModel.validate_obj_model_lv]),
+        ),
+        migrations.AlterField(
+            model_name='previousdeparture',
+            name='obj_moderation_level',
+            field=models.SmallIntegerField(default=0, validators=[django.core.validators.MinValueValidator(0), backend.models.my_model.myModel.validate_obj_model_lv]),
+        ),
+        migrations.AlterField(
+            model_name='previousdeparturefeedback',
+            name='obj_moderation_level',
+            field=models.SmallIntegerField(default=0, validators=[django.core.validators.MinValueValidator(0), backend.models.my_model.myModel.validate_obj_model_lv]),
+        ),
+        migrations.AlterField(
+            model_name='recommendation',
+            name='obj_moderation_level',
+            field=models.SmallIntegerField(default=0, validators=[django.core.validators.MinValueValidator(0), backend.models.my_model.myModel.validate_obj_model_lv]),
+        ),
+        migrations.AlterField(
+            model_name='recommendationlist',
+            name='obj_moderation_level',
+            field=models.SmallIntegerField(default=0, validators=[django.core.validators.MinValueValidator(0), backend.models.my_model.myModel.validate_obj_model_lv]),
+        ),
+        migrations.AlterField(
+            model_name='semester',
+            name='obj_moderation_level',
+            field=models.SmallIntegerField(default=0, validators=[django.core.validators.MinValueValidator(0), backend.models.my_model.myModel.validate_obj_model_lv]),
+        ),
+        migrations.AlterField(
+            model_name='specialty',
+            name='obj_moderation_level',
+            field=models.SmallIntegerField(default=0, validators=[django.core.validators.MinValueValidator(0), backend.models.my_model.myModel.validate_obj_model_lv]),
+        ),
+        migrations.AlterField(
+            model_name='tag',
+            name='obj_moderation_level',
+            field=models.SmallIntegerField(default=0, validators=[django.core.validators.MinValueValidator(0), backend.models.my_model.myModel.validate_obj_model_lv]),
+        ),
+        migrations.AlterField(
+            model_name='university',
+            name='obj_moderation_level',
+            field=models.SmallIntegerField(default=0, validators=[django.core.validators.MinValueValidator(0), backend.models.my_model.myModel.validate_obj_model_lv]),
+        ),
+        migrations.AlterField(
+            model_name='universitydri',
+            name='obj_moderation_level',
+            field=models.SmallIntegerField(default=0, validators=[django.core.validators.MinValueValidator(0), backend.models.my_model.myModel.validate_obj_model_lv]),
+        ),
+        migrations.AlterField(
+            model_name='universityinfo',
+            name='obj_moderation_level',
+            field=models.SmallIntegerField(default=0, validators=[django.core.validators.MinValueValidator(0), backend.models.my_model.myModel.validate_obj_model_lv]),
+        ),
+        migrations.AlterField(
+            model_name='universityscholarship',
+            name='obj_moderation_level',
+            field=models.SmallIntegerField(default=0, validators=[django.core.validators.MinValueValidator(0), backend.models.my_model.myModel.validate_obj_model_lv]),
+        ),
+        migrations.AlterField(
+            model_name='universitysemestersdates',
+            name='obj_moderation_level',
+            field=models.SmallIntegerField(default=0, validators=[django.core.validators.MinValueValidator(0), backend.models.my_model.myModel.validate_obj_model_lv]),
+        ),
+        migrations.AlterField(
+            model_name='universitytaggeditem',
+            name='obj_moderation_level',
+            field=models.SmallIntegerField(default=0, validators=[django.core.validators.MinValueValidator(0), backend.models.my_model.myModel.validate_obj_model_lv]),
+        ),
+        migrations.AlterField(
+            model_name='userdata',
+            name='obj_moderation_level',
+            field=models.SmallIntegerField(default=0, validators=[django.core.validators.MinValueValidator(0), backend.models.my_model.myModel.validate_obj_model_lv]),
+        ),
+    ]

backend/models/module/basicModule.py

@@ -16,7 +16,7 @@ class BasicModule(MyModelVersionned):
 
 class BasicModuleSerializer(MyModelVersionnedSerializer):
 
-    def validate(self, attrs):
+    def my_validate(self, attrs):
         content = {'usefull_links': attrs['usefull_links']}
         config = {'usefull_links': USEFULL_LINKS_CONFIG}
         validate_content_against_config(config, content)

backend/models/module/scholarship.py

@@ -27,7 +27,7 @@ class Scholarship(BasicModule):
 
 class ScholarshipSerializer(BasicModuleSerializer):
 
-    def validate(self, attrs):
+    def my_validate(self, attrs):
         if attrs['amount_max'] < attrs['amount_min']:
             raise serializers.ValidationError(
                 "Amount_max should be greater or equal than amount_min")

backend/models/my_model/myModel.py

@@ -2,6 +2,18 @@ from django.db import models
 from django.contrib.auth.models import User
 from django.contrib.contenttypes.fields import GenericRelation
 from .pendingModeration import PendingModeration
+from backend.permissions import OBJ_MODERATION_PERMISSIONS
+from django.core.validators import MinValueValidator
+from django.core.exceptions import ValidationError
+
+oml = OBJ_MODERATION_PERMISSIONS["authenticated_user"]
+POSSIBLE_OBJ_MODER_LV = [OBJ_MODERATION_PERMISSIONS[key]
+                         for key in OBJ_MODERATION_PERMISSIONS]
+
+
+def validate_obj_model_lv(value):
+    if value not in POSSIBLE_OBJ_MODER_LV:
+        raise ValidationError('obj_moderation_level not recognized')
 
 
 class MyModel(models.Model):
@@ -19,6 +31,8 @@ class MyModel(models.Model):
     updated_on = models.DateTimeField(null=True)
     updated_by = models.ForeignKey(
         User, null=True, on_delete=models.SET_NULL, related_name='+')
+    obj_moderation_level = models.SmallIntegerField(
+        default=oml, validators=[MinValueValidator(0), validate_obj_model_lv])
     pending_moderation = GenericRelation(PendingModeration)
 
     class Meta:

backend/models/my_model/myModelSerializer.py

 from rest_framework import serializers
+from rest_framework.validators import ValidationError
 from django.utils import timezone
 from .pendingModeration import PendingModeration
 from django.conf import settings
@@ -6,7 +7,7 @@ from django.contrib.contenttypes.models import ContentType
 from backend.utils import does_user_have_moderation_rights
 from .myModel import MyModel
 from .pendingModeration import PendingModerationSerializer
-
+from backend.utils import get_user_level
 
 CLEANED_MY_MODEL_DATA = {
     'moderated_by': None,
@@ -30,16 +31,10 @@ class MyModelSerializer(serializers.ModelSerializer):
     moderated_by = serializers.CharField(read_only=True)
     updated_by = serializers.CharField(read_only=True)
     pending_moderation = serializers.SerializerMethodField()
-    # pending_moderation = PendingModerationSerializer(many=True, read_only=True)
-
-    # TODO : updated_by_username useless ? See in rest API
-    updated_by_username = serializers.SerializerMethodField(read_only=True)
+    model_config = serializers.SerializerMethodField()
 
-    def get_updated_by_username(self, obj):
-        if obj.updated_by:
-            return obj.updated_by.username
-        else:
-            return None
+    def get_model_config(self, obj):
+        return self.Meta.model.model_config
 
     def get_pending_moderation(self, obj):
         if self.context['view'].action != 'list':
@@ -49,21 +44,44 @@ class MyModelSerializer(serializers.ModelSerializer):
     class Meta:
         model = MyModel
 
-    def moderation_required(self):
-        moderation_level = self.Meta.model.model_config['moderation_level']
-        user = self.get_user_in_request()
+    def my_validate(self, attrs):
+        return attrs
+
+    def validate(self, attrs):
+        self.user = self.get_user_in_request()
+        self.user_level = get_user_level(self.user)
+
+        if "obj_moderation_level" in attrs:
+            requested_obj_moder_lv = attrs["obj_moderation_level"]
 
-        if moderation_level == 0:
+            if requested_obj_moder_lv > self.user_level:
+                raise ValidationError(
+                    "You can't request moderation for a higher rank than you.")
+
+        return self.my_validate(attrs)
+
+    def moderation_required(self, obj_in_db):
+        model_moderation_level = self.Meta.model.model_config['moderation_level']
+
+        if model_moderation_level == 0:
             return False
-        elif moderation_level == 1:
-            if settings.MODERATION_ACTIVATED:
-                return not does_user_have_moderation_rights(user)
-            else:
-                return False
-        elif moderation_level == 2:
-            return not does_user_have_moderation_rights(user)
         else:
-            raise Exception("No other moderation level should be defined...")
+            # At this point we have to check the obj_moderation_level
+            if obj_in_db is not None:
+                obj_moderation_level = obj_in_db.obj_moderation_level
+                if self.user_level < obj_moderation_level:
+                    return True
+
+            if model_moderation_level == 1:
+                if settings.MODERATION_ACTIVATED:
+                    return not does_user_have_moderation_rights(self.user)
+                else:
+                    return False
+            elif model_moderation_level == 2:
+                return not does_user_have_moderation_rights(self.user)
+            else:
+                raise Exception(
+                    "No other moderation level should be defined...")
 
     def get_user_in_request(self):
         return self.context['request'].user
@@ -108,7 +126,7 @@ class MyModelSerializer(serializers.ModelSerializer):
         self.clean_validated_data()
         self.my_pre_save()
 
-        if self.moderation_required():
+        if self.moderation_required(self.instance):
             if self.instance is None:  # we need to create the main model
                 self.instance = super(
                     MyModelSerializer, self).save(*args, **kwargs)

backend/models/tag/taggedItem.py

@@ -15,7 +15,7 @@ class TaggedItem(MyModelVersionned):
 
 class TaggedItemSerializer(MyModelVersionnedSerializer):
 
-    def validate(self, attrs):
+    def my_validate(self, attrs):
         tagged_item_validation(attrs)
         return attrs
 

backend/models/university/universitySemestersDates.py

@@ -33,7 +33,7 @@ class UniversitySemestersDates(BasicModule):
 
 class UniversitySemestersDatesSerializer(BasicModuleSerializer):
 
-    def validate(self, attrs):
+    def my_validate(self, attrs):
         spring_ok = check_nones(attrs['spring_begin'], attrs['spring_end'])
         autumn_ok = check_nones(attrs['autumn_begin'], attrs['autumn_end'])
 

backend/permissions/__init__.py

@@ -4,3 +4,4 @@ from .noDelete import NoDelete  # noqa: F401
 from .isStaffOrReadOnly import IsStaffOrReadOnly  # noqa: F401
 from .isDriOrReadOnly import IsDriOrReadOnly  # noqa: F401
 from .default_viewset_permissions import DEFAULT_VIEWSET_PERMISSIONS  # noqa: F401
+from .obj_moderation_permission import OBJ_MODERATION_PERMISSIONS  # noqa: F401

backend/permissions/obj_moderation_permission.py

+OBJ_MODERATION_PERMISSIONS = {
+    "staff": 3,
+    "DRI": 2,
+    "moderator": 1,
+    "authenticated_user": 0
+}

backend/utils/__init__.py

@@ -4,3 +4,4 @@ from .find_api_end_point_for_viewset import find_api_end_point_for_viewset  # no
 from .get_model_config import get_model_config  # noqa: F401
 from .get_viewset_permissions import get_viewset_permissions  # noqa: F401
 from .does_user_have_moderation_rights import does_user_have_moderation_rights  # noqa: F401
+from .get_user_level import get_user_level  # noqa: F401

backend/utils/get_model_config.py

@@ -6,6 +6,6 @@ def get_model_config(model):
 
     for obj in api_config:
         if obj['model'] == model:
-            return obj
+            return {"moderation_level": obj["moderation_level"]}
 
     raise Exception("Model not found in API configuraiton, cannot process !")

backend/utils/get_user_level.py

+from .is_member import is_member
+from backend.permissions import OBJ_MODERATION_PERMISSIONS
+
+
+def get_user_level(user):
+    """
+    TODO unit test
+    """
+    if user.is_staff:
+        return OBJ_MODERATION_PERMISSIONS["staff"]
+    elif is_member('DRI', user):
+        return OBJ_MODERATION_PERMISSIONS["DRI"]
+    elif is_member('Moderators', user):
+        return OBJ_MODERATION_PERMISSIONS["moderator"]
+    else:
+        return OBJ_MODERATION_PERMISSIONS["authenticated_user"]

general/api/api_config.yml

@@ -18,7 +18,10 @@
 #     1 : moderation will be on if the global settings for moderation is turned on
 #     2 : (default for security reasons) moderation will always be on no matter what
 # It is to be noted that staff members, dri members and moderators won't be subject to moderation !
-# Dri might want to switch moderation on some models. TODO
+#
+# When moderation_level > 0, someone may decide to enforce moderation on for the users with a lower 
+#   status in the app. This is called object level moderation ! 
+#   staff ⊂ dri ⊂ moderators ⊂ authenficated_user 
 
 # For viewset permissions we have the followings
 #