[UPDT] PMS: Objective permissions changed

pms/views.py

@@ -753,38 +753,46 @@ def objective_detailed_view_activity(request, id):
     """
 
     objective = EmployeeObjective.objects.get(id=id)
-    key_result_history = objective_history(id)
-    history = objective.tracking()
-    comments = Comment.objects.filter(employee_objective_id=objective)
-    activity_list = []
-    for hist in history:
-        hist["date"] = hist["pair"][0].history_date
-        activity_list.append(hist)
-    for com in comments:
-        comment = {
-            "type": "comment",
-            "comment": com,
-            "date": com.created_at,
+    if (
+        request.user.employee_get == objective.employee_id
+        or request.user.employee_get in objective.objective_id.managers.all()
+        or request.user.has_perm("pms.view_comment")
+    ):
+        key_result_history = objective_history(id)
+        history = objective.tracking()
+        comments = Comment.objects.filter(employee_objective_id=objective)
+        activity_list = []
+        for hist in history:
+            hist["date"] = hist["pair"][0].history_date
+            activity_list.append(hist)
+        for com in comments:
+            comment = {
+                "type": "comment",
+                "comment": com,
+                "date": com.created_at,
+            }
+            activity_list.append(comment)
+
+        for key in key_result_history:
+            key_result = {
+                "type": "key_result",
+                "key_result": key,
+                "date": key["changed_date"],
+            }
+            activity_list.append(key_result)
+
+        activity_list = sorted(activity_list, key=lambda x: x["date"], reverse=True)
+
+        context = {
+            "objective": objective,
+            "historys": history,
+            "comments": comments,
+            "activity_list": activity_list,
         }
-        activity_list.append(comment)
-
-    for key in key_result_history:
-        key_result = {
-            "type": "key_result",
-            "key_result": key,
-            "date": key["changed_date"],
-        }
-        activity_list.append(key_result)
-
-    activity_list = sorted(activity_list, key=lambda x: x["date"], reverse=True)
-
-    context = {
-        "objective": objective,
-        "historys": history,
-        "comments": comments,
-        "activity_list": activity_list,
-    }
-    return render(request, "okr/objective_detailed_view_activity.html", context)
+        return render(request, "okr/objective_detailed_view_activity.html", context)
+    else:
+        messages.info(request, _("You dont have permission."))
+        return HttpResponse("<script>window.location.reload();</script>")
 
 
 @login_required
@@ -1069,7 +1077,6 @@ def create_employee_objective(request):
 
 @login_required
 @hx_request_required
-@manager_can_enter(perm="pms.change_employeeobjective")
 def update_employee_objective(request, emp_obj_id):
     """
     This function is used to update the employee objective
@@ -1079,16 +1086,23 @@ def update_employee_objective(request, emp_obj_id):
             redirect to form of employee objective
     """
     emp_objective = EmployeeObjective.objects.get(id=emp_obj_id)
-    form = EmployeeObjectiveForm(instance=emp_objective)
-    if request.method == "POST":
-        form = EmployeeObjectiveForm(request.POST, instance=emp_objective)
-        if form.is_valid():
-            emp_obj = form.save(commit=False)
-            emp_obj.save()
-            messages.success(request, _("Employee objective Updated successfully"))
-            return HttpResponse("<script>window.location.reload()</script>")
-    context = {"form": form, "k_form": KRForm()}
-    return render(request, "okr/emp_objective_form.html", context=context)
+    if (
+        request.user.employee_get == emp_objective.employee_id
+        or request.user.employee_get in emp_objective.objective_id.managers.all()
+    ):
+        form = EmployeeObjectiveForm(instance=emp_objective)
+        if request.method == "POST":
+            form = EmployeeObjectiveForm(request.POST, instance=emp_objective)
+            if form.is_valid():
+                emp_obj = form.save(commit=False)
+                emp_obj.save()
+                messages.success(request, _("Employee objective Updated successfully"))
+                return HttpResponse("<script>window.location.reload()</script>")
+        context = {"form": form, "k_form": KRForm()}
+        return render(request, "okr/emp_objective_form.html", context=context)
+    else:
+        messages.info(request, _("You don't have permission."))
+        return HttpResponse("<script>window.location.reload()</script>")
 
 
 @login_required
@@ -3069,7 +3083,6 @@ def view_single_anonymous_feedback(request, obj_id):
 
 @login_required
 @hx_request_required
-@manager_can_enter(perm="pms.add_employeekeyresult")
 def employee_keyresult_creation(request, emp_obj_id):
     """
     This view is for employee keyresult creation , and returns a employee keyresult form.
@@ -3080,47 +3093,54 @@ def employee_keyresult_creation(request, emp_obj_id):
             employee keyresult created, and returnes to employee objective details view
     """
     emp_objective = EmployeeObjective.objects.get(id=emp_obj_id)
-    employee = emp_objective.employee_id
-    data = request.GET.copy()
-    # Convert QueryDict to a regular dictionary
-    cleaned_data = {
-        key: value if len(value) > 1 else value[0] for key, value in data.lists()
-    }
-    if not cleaned_data.get("employee_objective_id"):
-        cleaned_data["employee_objective_id"] = emp_obj_id
-    emp_key_result = EmployeeKeyResultForm(initial=cleaned_data)
-    if request.method == "POST":
-        emp_key_result = EmployeeKeyResultForm(request.POST)
-        if emp_key_result.is_valid():
-            emp_key_result.save()
-            emp_objective.update_objective_progress()
-            key_result = emp_key_result.cleaned_data["key_result_id"]
+    if (
+        request.user.employee_get in emp_objective.objective_id.managers.all()
+        or request.user.has_perm("pms.add_employeekeyresult")
+    ):
+        employee = emp_objective.employee_id
+        data = request.GET.copy()
+        # Convert QueryDict to a regular dictionary
+        cleaned_data = {
+            key: value if len(value) > 1 else value[0] for key, value in data.lists()
+        }
+        if not cleaned_data.get("employee_objective_id"):
+            cleaned_data["employee_objective_id"] = emp_obj_id
+        emp_key_result = EmployeeKeyResultForm(initial=cleaned_data)
+        if request.method == "POST":
+            emp_key_result = EmployeeKeyResultForm(request.POST)
+            if emp_key_result.is_valid():
+                emp_key_result.save()
+                emp_objective.update_objective_progress()
+                key_result = emp_key_result.cleaned_data["key_result_id"]
 
-            emp_objective.key_result_id.add(key_result)
-            # assignees = emp_key_result.cleaned_data['assignees']
-            # start_date =emp_key_result.cleaned_data['start_date']
+                emp_objective.key_result_id.add(key_result)
+                # assignees = emp_key_result.cleaned_data['assignees']
+                # start_date =emp_key_result.cleaned_data['start_date']
 
-            messages.success(request, _("Key result assigned sucessfully."))
+                messages.success(request, _("Key result assigned sucessfully."))
 
-            notify.send(
-                request.user.employee_get,
-                recipient=employee.employee_user_id,
-                verb="You got an Key Result!.",
-                verb_ar="لقد حصلت على نتيجة رئيسية!",
-                verb_de="Du hast ein Schlüsselergebnis erreicht!",
-                verb_es="¡Has conseguido un Resultado Clave!",
-                verb_fr="Vous avez obtenu un Résultat Clé!",
-                redirect=reverse(
-                    "objective-detailed-view",
-                    kwargs={"obj_id": emp_objective.objective_id.id},
-                ),
-            )
-            return HttpResponse("<script>window.location.reload()</script>")
-    context = {
-        "form": emp_key_result,
-        "emp_objective": emp_objective,
-    }
-    return render(request, "okr/key_result/kr_form.html", context=context)
+                notify.send(
+                    request.user.employee_get,
+                    recipient=employee.employee_user_id,
+                    verb="You got an Key Result!.",
+                    verb_ar="لقد حصلت على نتيجة رئيسية!",
+                    verb_de="Du hast ein Schlüsselergebnis erreicht!",
+                    verb_es="¡Has conseguido un Resultado Clave!",
+                    verb_fr="Vous avez obtenu un Résultat Clé!",
+                    redirect=reverse(
+                        "objective-detailed-view",
+                        kwargs={"obj_id": emp_objective.objective_id.id},
+                    ),
+                )
+                return HttpResponse("<script>window.location.reload()</script>")
+        context = {
+            "form": emp_key_result,
+            "emp_objective": emp_objective,
+        }
+        return render(request, "okr/key_result/kr_form.html", context=context)
+    else:
+        messages.info(request, _("You are don't have permissions."))
+        return HttpResponse("<script>window.location.reload()</script>")
 
 
 @login_required