From 2cf5ef6ebe59c1a73dbaff6730dd7c2ffb8f7647 Mon Sep 17 00:00:00 2001
From: Horilla <support@horilla.com>
Date: Sat, 21 Dec 2024 15:45:26 +0530
Subject: [PATCH] [UPDT] PMS: Objective permissions changed

---
 .../okr/emp_objective/emp_objective_list.html |  10 +-
 pms/views.py                                  | 182 ++++++++++--------
 2 files changed, 106 insertions(+), 86 deletions(-)

diff --git a/pms/templates/okr/emp_objective/emp_objective_list.html b/pms/templates/okr/emp_objective/emp_objective_list.html
index 7965ddba8..a812106d4 100644
--- a/pms/templates/okr/emp_objective/emp_objective_list.html
+++ b/pms/templates/okr/emp_objective/emp_objective_list.html
@@ -82,7 +82,7 @@
                                         >
                                             <ion-icon name="eye-outline"></ion-icon>
                                         </a>
-                                    {% if request.user|is_reportingmanager or perms.pms.view_employeekeyresult %}
+                                    {% if request.user.employee_get in emp_objective.objective_id.managers.all or emp_objective.employee_id == request.user.employee_get or perms.pms.view_employeekeyresult %}
                                         <a
                                             hx-get='{% url "objective-detailed-view-activity" emp_objective.id %}'
                                             hx-target="#activityContainer"
@@ -93,7 +93,7 @@
                                             <ion-icon name="newspaper-outline"></ion-icon>
                                         </a>
                                     {% endif %}
-                                    {% if request.user|is_reportingmanager or perms.pms.add_employeekeyresult %}
+                                    {% if request.user.employee_get in emp_objective.objective_id.managers.all or perms.pms.add_employeekeyresult %}
                                         <button  style="border-right:1px solid hsl(8, 77%, 56%)"
                                             class="oh-btn oh-btn--secondary-outline float-end"
                                             hx-get='{% url "employee-key-result-creation" emp_objective.id %}'
@@ -106,7 +106,7 @@
                                             <ion-icon name="add-outline" class="m-0 md hydrated" role="img" aria-label="add outline"></ion-icon>
                                         </button>
                                     {% endif %}
-                                    {% if request.user|is_reportingmanager or perms.pms.add_employeeobjective %}
+                                    {% if request.user.employee_get in emp_objective.objective_id.managers.all or perms.pms.add_employeeobjective %}
 
                                     <div class="" onclick="event.stopPropagation()">
                                         <div class="oh-dropdown" x-data="{show: false}">
@@ -115,7 +115,7 @@
                                             </button>
                                             <div class="oh-dropdown__menu oh-dropdown__menu--dark-border oh-dropdown__menu--right" x-show="show" @click.outside="show = false" style="display: none;">
                                                 <ul class="oh-dropdown__items">
-                                                {% if perms.pms.change_employeeobjective or request.user|is_reportingmanager %}
+                                                {% if perms.pms.change_employeeobjective or request.user.employee_get in emp_objective.objective_id.managers.all %}
                                                     <li class="oh-dropdown__item">
                                                         <a
                                                         class="fw-light"
@@ -146,7 +146,7 @@
                                                     {% endif %}
 
                                                 {% endif %}
-                                                {% if perms.pms.delete_employeeobjective or request.user|is_reportingmanager %}
+                                                {% if perms.pms.delete_employeeobjective or request.user.employee_get in emp_objective.objective_id.managers.all %}
                                                     <li class="oh-dropdown__item">
                                                         <a
                                                         class="fw-light"
diff --git a/pms/views.py b/pms/views.py
index 58c351d65..15f834900 100644
--- a/pms/views.py
+++ b/pms/views.py
@@ -753,38 +753,46 @@ def objective_detailed_view_activity(request, id):
     """
 
     objective = EmployeeObjective.objects.get(id=id)
-    key_result_history = objective_history(id)
-    history = objective.tracking()
-    comments = Comment.objects.filter(employee_objective_id=objective)
-    activity_list = []
-    for hist in history:
-        hist["date"] = hist["pair"][0].history_date
-        activity_list.append(hist)
-    for com in comments:
-        comment = {
-            "type": "comment",
-            "comment": com,
-            "date": com.created_at,
+    if (
+        request.user.employee_get == objective.employee_id
+        or request.user.employee_get in objective.objective_id.managers.all()
+        or request.user.has_perm("pms.view_comment")
+    ):
+        key_result_history = objective_history(id)
+        history = objective.tracking()
+        comments = Comment.objects.filter(employee_objective_id=objective)
+        activity_list = []
+        for hist in history:
+            hist["date"] = hist["pair"][0].history_date
+            activity_list.append(hist)
+        for com in comments:
+            comment = {
+                "type": "comment",
+                "comment": com,
+                "date": com.created_at,
+            }
+            activity_list.append(comment)
+
+        for key in key_result_history:
+            key_result = {
+                "type": "key_result",
+                "key_result": key,
+                "date": key["changed_date"],
+            }
+            activity_list.append(key_result)
+
+        activity_list = sorted(activity_list, key=lambda x: x["date"], reverse=True)
+
+        context = {
+            "objective": objective,
+            "historys": history,
+            "comments": comments,
+            "activity_list": activity_list,
         }
-        activity_list.append(comment)
-
-    for key in key_result_history:
-        key_result = {
-            "type": "key_result",
-            "key_result": key,
-            "date": key["changed_date"],
-        }
-        activity_list.append(key_result)
-
-    activity_list = sorted(activity_list, key=lambda x: x["date"], reverse=True)
-
-    context = {
-        "objective": objective,
-        "historys": history,
-        "comments": comments,
-        "activity_list": activity_list,
-    }
-    return render(request, "okr/objective_detailed_view_activity.html", context)
+        return render(request, "okr/objective_detailed_view_activity.html", context)
+    else:
+        messages.info(request, _("You dont have permission."))
+        return HttpResponse("<script>window.location.reload();</script>")
 
 
 @login_required
@@ -1069,7 +1077,6 @@ def create_employee_objective(request):
 
 @login_required
 @hx_request_required
-@manager_can_enter(perm="pms.change_employeeobjective")
 def update_employee_objective(request, emp_obj_id):
     """
     This function is used to update the employee objective
@@ -1079,16 +1086,23 @@ def update_employee_objective(request, emp_obj_id):
             redirect to form of employee objective
     """
     emp_objective = EmployeeObjective.objects.get(id=emp_obj_id)
-    form = EmployeeObjectiveForm(instance=emp_objective)
-    if request.method == "POST":
-        form = EmployeeObjectiveForm(request.POST, instance=emp_objective)
-        if form.is_valid():
-            emp_obj = form.save(commit=False)
-            emp_obj.save()
-            messages.success(request, _("Employee objective Updated successfully"))
-            return HttpResponse("<script>window.location.reload()</script>")
-    context = {"form": form, "k_form": KRForm()}
-    return render(request, "okr/emp_objective_form.html", context=context)
+    if (
+        request.user.employee_get == emp_objective.employee_id
+        or request.user.employee_get in emp_objective.objective_id.managers.all()
+    ):
+        form = EmployeeObjectiveForm(instance=emp_objective)
+        if request.method == "POST":
+            form = EmployeeObjectiveForm(request.POST, instance=emp_objective)
+            if form.is_valid():
+                emp_obj = form.save(commit=False)
+                emp_obj.save()
+                messages.success(request, _("Employee objective Updated successfully"))
+                return HttpResponse("<script>window.location.reload()</script>")
+        context = {"form": form, "k_form": KRForm()}
+        return render(request, "okr/emp_objective_form.html", context=context)
+    else:
+        messages.info(request, _("You don't have permission."))
+        return HttpResponse("<script>window.location.reload()</script>")
 
 
 @login_required
@@ -3069,7 +3083,6 @@ def view_single_anonymous_feedback(request, obj_id):
 
 @login_required
 @hx_request_required
-@manager_can_enter(perm="pms.add_employeekeyresult")
 def employee_keyresult_creation(request, emp_obj_id):
     """
     This view is for employee keyresult creation , and returns a employee keyresult form.
@@ -3080,47 +3093,54 @@ def employee_keyresult_creation(request, emp_obj_id):
             employee keyresult created, and returnes to employee objective details view
     """
     emp_objective = EmployeeObjective.objects.get(id=emp_obj_id)
-    employee = emp_objective.employee_id
-    data = request.GET.copy()
-    # Convert QueryDict to a regular dictionary
-    cleaned_data = {
-        key: value if len(value) > 1 else value[0] for key, value in data.lists()
-    }
-    if not cleaned_data.get("employee_objective_id"):
-        cleaned_data["employee_objective_id"] = emp_obj_id
-    emp_key_result = EmployeeKeyResultForm(initial=cleaned_data)
-    if request.method == "POST":
-        emp_key_result = EmployeeKeyResultForm(request.POST)
-        if emp_key_result.is_valid():
-            emp_key_result.save()
-            emp_objective.update_objective_progress()
-            key_result = emp_key_result.cleaned_data["key_result_id"]
+    if (
+        request.user.employee_get in emp_objective.objective_id.managers.all()
+        or request.user.has_perm("pms.add_employeekeyresult")
+    ):
+        employee = emp_objective.employee_id
+        data = request.GET.copy()
+        # Convert QueryDict to a regular dictionary
+        cleaned_data = {
+            key: value if len(value) > 1 else value[0] for key, value in data.lists()
+        }
+        if not cleaned_data.get("employee_objective_id"):
+            cleaned_data["employee_objective_id"] = emp_obj_id
+        emp_key_result = EmployeeKeyResultForm(initial=cleaned_data)
+        if request.method == "POST":
+            emp_key_result = EmployeeKeyResultForm(request.POST)
+            if emp_key_result.is_valid():
+                emp_key_result.save()
+                emp_objective.update_objective_progress()
+                key_result = emp_key_result.cleaned_data["key_result_id"]
 
-            emp_objective.key_result_id.add(key_result)
-            # assignees = emp_key_result.cleaned_data['assignees']
-            # start_date =emp_key_result.cleaned_data['start_date']
+                emp_objective.key_result_id.add(key_result)
+                # assignees = emp_key_result.cleaned_data['assignees']
+                # start_date =emp_key_result.cleaned_data['start_date']
 
-            messages.success(request, _("Key result assigned sucessfully."))
+                messages.success(request, _("Key result assigned sucessfully."))
 
-            notify.send(
-                request.user.employee_get,
-                recipient=employee.employee_user_id,
-                verb="You got an Key Result!.",
-                verb_ar="لقد حصلت على نتيجة رئيسية!",
-                verb_de="Du hast ein Schlüsselergebnis erreicht!",
-                verb_es="¡Has conseguido un Resultado Clave!",
-                verb_fr="Vous avez obtenu un Résultat Clé!",
-                redirect=reverse(
-                    "objective-detailed-view",
-                    kwargs={"obj_id": emp_objective.objective_id.id},
-                ),
-            )
-            return HttpResponse("<script>window.location.reload()</script>")
-    context = {
-        "form": emp_key_result,
-        "emp_objective": emp_objective,
-    }
-    return render(request, "okr/key_result/kr_form.html", context=context)
+                notify.send(
+                    request.user.employee_get,
+                    recipient=employee.employee_user_id,
+                    verb="You got an Key Result!.",
+                    verb_ar="لقد حصلت على نتيجة رئيسية!",
+                    verb_de="Du hast ein Schlüsselergebnis erreicht!",
+                    verb_es="¡Has conseguido un Resultado Clave!",
+                    verb_fr="Vous avez obtenu un Résultat Clé!",
+                    redirect=reverse(
+                        "objective-detailed-view",
+                        kwargs={"obj_id": emp_objective.objective_id.id},
+                    ),
+                )
+                return HttpResponse("<script>window.location.reload()</script>")
+        context = {
+            "form": emp_key_result,
+            "emp_objective": emp_objective,
+        }
+        return render(request, "okr/key_result/kr_form.html", context=context)
+    else:
+        messages.info(request, _("You are don't have permissions."))
+        return HttpResponse("<script>window.location.reload()</script>")
 
 
 @login_required