From 97e446f54ad747773a2fa195e7cc3168bb1d78b9 Mon Sep 17 00:00:00 2001
From: Christian Merten <christian@merten.dev>
Date: Sun, 1 Dec 2024 23:39:38 +0100
Subject: [PATCH] members/waitinglist: fix permissions

---
 jdav_web/members/admin.py                       | 16 +++++++++++++++-
 jdav_web/members/models.py                      |  7 +++++++
 jdav_web/templates/admin/members/app_index.html |  2 +-
 3 files changed, 23 insertions(+), 2 deletions(-)

diff --git a/jdav_web/members/admin.py b/jdav_web/members/admin.py
index 03ec02f..14eabd0 100644
--- a/jdav_web/members/admin.py
+++ b/jdav_web/members/admin.py
@@ -443,6 +443,20 @@ class MemberUnconfirmedAdmin(CommonAdminMixin, admin.ModelAdmin):
     inlines = [EmergencyContactInline]
     change_form_template = "members/change_member_unconfirmed.html"
 
+    field_view_permissions = {
+        'user': 'members.may_set_auth_user',
+        'good_conduct_certificate_presented_date': 'members.may_change_organizationals',
+        'has_key': 'members.may_change_organizationals',
+        'has_free_ticket_gym': 'members.may_change_organizationals',
+    }
+
+    field_change_permissions = {
+        'user': 'members.may_set_auth_user',
+        'good_conduct_certificate_presented_date': 'members.may_change_organizationals',
+        'has_key': 'members.may_change_organizationals',
+        'has_free_ticket_gym': 'members.may_change_organizationals',
+    }
+
     def has_add_permission(self, request, obj=None):
         return False
 
@@ -554,7 +568,7 @@ class WaiterInviteForm(forms.Form):
                                    label=_('Group'))
 
 
-class InvitationToGroupAdmin(CommonAdminInlineMixin, admin.TabularInline):
+class InvitationToGroupAdmin(admin.TabularInline):
     model = InvitationToGroup
     fields = ['group', 'date', 'status']
     readonly_fields = ['group', 'date', 'status']
diff --git a/jdav_web/members/models.py b/jdav_web/members/models.py
index 4d1c70b..ae4ee74 100644
--- a/jdav_web/members/models.py
+++ b/jdav_web/members/models.py
@@ -498,6 +498,8 @@ class Member(Person):
             return queryset
         elif name == "EmergencyContact":
             return queryset
+        elif name == "MemberUnconfirmedProxy":
+            return queryset
         else:
             raise ValueError(name)
 
@@ -731,6 +733,11 @@ class MemberUnconfirmedProxy(Member):
         verbose_name = _('Unconfirmed registration')
         verbose_name_plural = _('Unconfirmed registrations')
         permissions = (('may_manage_all_registrations', 'Can view and manage all unconfirmed registrations.'),)
+        rules_permissions = {
+            'view_obj': may_view | has_global_perm('members.may_manage_all_registrations'),
+            'change_obj': may_change | has_global_perm('members.may_manage_all_registrations'),
+            'delete_obj': may_delete | has_global_perm('members.may_manage_all_registrations'),
+        }
 
     def __str__(self):
         """String representation"""
diff --git a/jdav_web/templates/admin/members/app_index.html b/jdav_web/templates/admin/members/app_index.html
index d8c2634..ee92ac4 100644
--- a/jdav_web/templates/admin/members/app_index.html
+++ b/jdav_web/templates/admin/members/app_index.html
@@ -24,7 +24,7 @@ Hier siehst du alle Teilnehmer*innen deiner Jugendgruppen und alle von dir gelei
     </tr>
 </table>
 <table>
-{% if perms.members.change_waitinglist %}
+{% if perms.members.may_manage_waiting_list %}
 <br>
 <div class="app-members module current-app">
 <h2>Neue Mitglieder</h2>