Skip to content

fix the problems with project sharing #478

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
josihoppe wants to merge 14 commits into
base: main
Choose a base branch
from
Draft

fix the problems with project sharing #478

Show file tree
Hide file tree
Changes from 6 commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
2d62955
added decorator for edit and read viewer rights
josihoppe May 26, 2026
cd0d7db
exchanged repeating check for viewer share rights with decorator in p…
josihoppe May 26, 2026
dbfc323
fixed worng variable name in decorator
josihoppe May 27, 2026
c263048
added different return view_func behavior for views with different pa…
josihoppe May 27, 2026
15eec75
added decorators and user.has_edit_rights checks to more complex view…
josihoppe May 27, 2026
3a8c305
exchanged repeating checks for viewer share rigths with decorator in …
josihoppe May 27, 2026
fee5c9d
removed doubled viewer right check
josihoppe May 27, 2026
668ddc6
added new decorator if just the owner of project has permission
josihoppe May 27, 2026
3142fc2
added is owner decorator to project views
josihoppe Jun 3, 2026
5e7e06d
renamed decorators
josihoppe Jun 3, 2026
7b3507e
added another shorter check
josihoppe Jun 3, 2026
989f0e6
changed permission for seeing t and updating imeseries graph to edit …
josihoppe Jun 3, 2026
1280f31
changed permission for duplicating a shared scenario in own project o…
josihoppe Jun 3, 2026
2e81d0d
changed permission for deleting project in own project overview to re…
josihoppe Jun 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
84 changes: 17 additions & 67 deletions app/dashboard/views.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,7 @@
get_selected_scenarios_in_cache,
)

from projects.decorators import viewer_has_edit_rights, viewer_has_view_rights
from projects.forms import BusForm, AssetCreateForm, StorageForm

from projects.constants import COMPARE_VIEW, STEP_LIST, MAX_STEP
Expand Down Expand Up @@ -72,13 +73,9 @@
@login_required
@json_view
@require_http_methods(["GET"])
@viewer_has_view_rights
Comment thread
josihoppe marked this conversation as resolved.
Outdated
def scenario_available_results(request, scen_id):
scenario = get_object_or_404(Scenario, pk=scen_id)
if (scenario.project.user != request.user) and (
scenario.project.viewers.filter(user__email=request.user.email).exists()
is False
):
raise PermissionDenied

try:
assets_results_obj = AssetsResults.objects.get(simulation=scenario.simulation)
Expand Down Expand Up @@ -174,9 +171,7 @@ def scenario_visualize_results(
)
else:
project = get_object_or_404(Project, id=proj_id)
if (project.user != request.user) and (
project.viewers.filter(user__email=request.user.email).exists() is False
):
if not request.user.has_read_rights(project):
raise PermissionDenied

selected_scenarios = get_selected_scenarios_in_cache(request, proj_id)
Expand Down Expand Up @@ -271,6 +266,7 @@ def scenario_visualize_results(

@login_required
@require_http_methods(["POST", "GET"])
@viewer_has_view_rights
def project_compare_results(request, proj_id, step_id=5, max_step=MAX_STEP):
request.session[COMPARE_VIEW] = True
user_projects = fetch_user_projects(request.user)
Expand All @@ -281,10 +277,6 @@ def project_compare_results(request, proj_id, step_id=5, max_step=MAX_STEP):
)

project = get_object_or_404(Project, id=proj_id)
if (project.user != request.user) and (
project.viewers.filter(user__email=request.user.email).exists() is False
):
raise PermissionDenied

user_scenarios = project.get_scenarios_with_results()
report_items_data = [
Expand Down Expand Up @@ -340,10 +332,7 @@ def project_sensitivity_analysis(request, proj_id, sa_id=None):
)
else:
project = get_object_or_404(Project, id=proj_id)
if (scenario.project.user != request.user) and (
scenario.project.viewers.filter(user__email=request.user.email).exists()
is False
):
if not request.user.has_read_rights(project):
raise PermissionDenied

user_sa = get_project_sensitivity_analysis(project)
Expand Down Expand Up @@ -1002,6 +991,7 @@ def view_asset_parameters(request, scen_id, asset_type_name, asset_uuid):
@login_required
@json_view
@require_http_methods(["GET"])
@viewer_has_view_rights
def scenario_economic_results(request, scen_id=None):
"""
This view gathers all simulation specific cost matrix KPI results
Expand All @@ -1017,14 +1007,6 @@ def scenario_economic_results(request, scen_id=None):

scenario = get_object_or_404(Scenario, pk=scen_id)

# if scenario.project.user != request.user:
# return HttpResponseForbidden()
if (scenario.project.user != request.user) and (
scenario.project.viewers.filter(user__email=request.user.email).exists()
is False
):
raise PermissionDenied

try:
kpi_cost_results_obj = KPICostsMatrixResults.objects.get(
simulation=scenario.simulation
Expand Down Expand Up @@ -1093,6 +1075,7 @@ def scenario_economic_results(request, scen_id=None):
@login_required
@json_view
@require_http_methods(["GET"])
@viewer_has_view_rights
def scenario_visualize_timeseries(request, proj_id=None, scen_id=None):
if scen_id is None:
selected_scenario = get_selected_scenarios_in_cache(request, proj_id)
Expand All @@ -1103,11 +1086,6 @@ def scenario_visualize_timeseries(request, proj_id=None, scen_id=None):

for scen_id in selected_scenario:
scenario = get_object_or_404(Scenario, pk=scen_id)
if (scenario.project.user != request.user) and (
scenario.project.viewers.filter(user__email=request.user.email).exists()
is False
):
raise PermissionDenied
simulations.append(scenario.simulation)

results_json = report_item_render_to_json(
Expand All @@ -1122,13 +1100,10 @@ def scenario_visualize_timeseries(request, proj_id=None, scen_id=None):
)


@login_required
@viewer_has_view_rights
def scenario_visualize_stacked_timeseries(request, scen_id):
scenario = get_object_or_404(Scenario, pk=scen_id)
if (scenario.project.user != request.user) and (
scenario.project.viewers.filter(user__email=request.user.email).exists()
is False
):
raise PermissionDenied

results_json = []
for energy_vector in scenario.energy_vectors:
Expand All @@ -1151,6 +1126,7 @@ def scenario_visualize_stacked_timeseries(request, scen_id):


# TODO exclude sink components
@viewer_has_view_rights
def scenario_visualize_capacities(request, proj_id, scen_id=None):
if scen_id is None:
selected_scenario = get_selected_scenarios_in_cache(request, proj_id)
Expand All @@ -1161,11 +1137,6 @@ def scenario_visualize_capacities(request, proj_id, scen_id=None):

qs = Scenario.objects.filter(id__in=selected_scenario).order_by("name")
for scenario in qs:
if (scenario.project.user != request.user) and (
scenario.project.viewers.filter(user__email=request.user.email).exists()
is False
):
raise PermissionDenied
simulations.append(scenario.simulation)

results_json = report_item_render_to_json(
Expand All @@ -1180,6 +1151,7 @@ def scenario_visualize_capacities(request, proj_id, scen_id=None):
)


@viewer_has_view_rights
def scenario_visualize_costs(request, proj_id, scen_id=None):
if scen_id is None:
selected_scenario = get_selected_scenarios_in_cache(request, proj_id)
Expand All @@ -1190,11 +1162,6 @@ def scenario_visualize_costs(request, proj_id, scen_id=None):

qs = Scenario.objects.filter(id__in=selected_scenario).order_by("name")
for scenario in qs:
if (scenario.project.user != request.user) and (
scenario.project.viewers.filter(user__email=request.user.email).exists()
is False
):
raise PermissionDenied
simulations.append(scenario.simulation)

results_json = []
Expand All @@ -1216,13 +1183,11 @@ def scenario_visualize_costs(request, proj_id, scen_id=None):


# TODO: Sector coupling must be refined (including transformer flows)
@login_required
@viewer_has_view_rights
def scenario_visualize_sankey(request, scen_id, ts=None):
scenario = get_object_or_404(Scenario, pk=scen_id)
if (scenario.project.user != request.user) and (
scenario.project.viewers.filter(user__email=request.user.email).exists()
is False
):
raise PermissionDenied

if ts is not None:
ts = int(ts)
results_json = report_item_render_to_json(
Expand All @@ -1243,15 +1208,10 @@ def scenario_visualize_sankey(request, scen_id, ts=None):

@login_required
@require_http_methods(["GET"])
@viewer_has_view_rights
def download_scalar_results(request, scen_id):
scenario = get_object_or_404(Scenario, pk=scen_id)

if (scenario.project.user != request.user) and (
scenario.project.viewers.filter(user__email=request.user.email).exists()
is False
):
raise PermissionDenied

try:
kpi_scalar_results_obj = KPIScalarResults.objects.get(
simulation=scenario.simulation
Expand Down Expand Up @@ -1290,15 +1250,10 @@ def download_scalar_results(request, scen_id):

@login_required
@require_http_methods(["GET"])
@viewer_has_view_rights
def download_cost_results(request, scen_id):
scenario = get_object_or_404(Scenario, pk=scen_id)

if (scenario.project.user != request.user) and (
scenario.project.viewers.filter(user__email=request.user.email).exists()
is False
):
raise PermissionDenied

try:
kpi_cost_results_obj = KPICostsMatrixResults.objects.get(
simulation=scenario.simulation
Expand Down Expand Up @@ -1336,15 +1291,10 @@ def download_cost_results(request, scen_id):

@login_required
@require_http_methods(["GET"])
@viewer_has_view_rights
def download_timeseries_results(request, scen_id):
scenario = get_object_or_404(Scenario, pk=scen_id)

if (scenario.project.user != request.user) and (
scenario.project.viewers.filter(user__email=request.user.email).exists()
is False
):
raise PermissionDenied

try:
assets_results_obj = AssetsResults.objects.get(simulation=scenario.simulation)
assets_results_json = json.loads(assets_results_obj.assets_list)
Expand Down
57 changes: 57 additions & 0 deletions app/projects/decorators.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,57 @@
from django.core.exceptions import PermissionDenied
from django.shortcuts import get_object_or_404

from functools import wraps

from projects.models import Project, Scenario


def viewer_has_view_rights(view_func):
@wraps(view_func)
def _wrapped_view(request, proj_id=None, scen_id=None, *args, **kwargs):
if proj_id:
project = get_object_or_404(Project, pk=proj_id)
elif scen_id:
scenario = get_object_or_404(Scenario, pk=scen_id)
project = scenario.project
# oder ersetzen durch user.has_read_rights
if (project.user != request.user) and (
project.viewers.filter(user__email=request.user.email).exists() is False
):
raise PermissionDenied
# check for existing parameters to handle the different view parameters
if proj_id is not None and scen_id is not None:
return view_func(request, proj_id, scen_id, *args, **kwargs)
elif proj_id is not None:
return view_func(request, proj_id, *args, **kwargs)
elif scen_id is not None:
return view_func(request, scen_id, *args, **kwargs)

return _wrapped_view


def viewer_has_edit_rights(view_func):
@wraps(view_func)
def _wrapped_view(request, proj_id=None, scen_id=None, *args, **kwargs):
if proj_id:
project = get_object_or_404(Project, pk=proj_id)
elif scen_id:
scenario = get_object_or_404(Scenario, pk=scen_id)
project = scenario.project
# oder ersetzen durch user.has_edit_rights
if (project.user != request.user) and (
project.viewers.filter(
user__email=request.user.email, share_rights="edit"
).exists()
is False
):
raise PermissionDenied
# check for existing parameters to handle the different view parameters
if proj_id is not None and scen_id is not None:
return view_func(request, proj_id, scen_id, *args, **kwargs)
elif proj_id is not None:
return view_func(request, proj_id, *args, **kwargs)
elif scen_id is not None:
return view_func(request, scen_id, *args, **kwargs)

return _wrapped_view
Loading
Loading