No-show page permissions filtering

Celeo · Nov 18, 2024 · 194e8cc · 194e8cc
1 parent 59da79f
commit 194e8cc
Show file tree

Hide file tree

Showing 4 changed files with 40 additions and 8 deletions.
diff --git a/vzdv-site/src/endpoints/admin.rs b/vzdv-site/src/endpoints/admin.rs
@@ -983,9 +983,34 @@ async fn page_no_show_list(
     {
         return Ok(redirect.into_response());
     }
-    let no_shows: Vec<NoShow> = sqlx::query_as(sql::GET_ALL_NO_SHOW)
-        .fetch_all(&state.db)
-        .await?;
+    let user_info = user_info.unwrap();
+
+    let (filtering, no_shows) = {
+        let no_shows: Vec<NoShow> = sqlx::query_as(sql::GET_ALL_NO_SHOW)
+            .fetch_all(&state.db)
+            .await?;
+
+        if user_info.is_admin || (user_info.is_event_staff && user_info.is_training_staff) {
+            ("all", no_shows)
+        } else {
+            let filter = if user_info.is_event_staff {
+                "event"
+            } else if user_info.is_training_staff {
+                "training"
+            } else {
+                "none"
+            };
+            (
+                filter,
+                no_shows
+                    .iter()
+                    .filter(|ns| ns.entry_type == filter)
+                    .map(|ns| ns.to_owned())
+                    .collect(),
+            )
+        }
+    };
+
     let all_controllers: Vec<Controller> = sqlx::query_as(sql::GET_ALL_CONTROLLERS)
         .fetch_all(&state.db)
         .await?;
@@ -1022,6 +1047,7 @@ async fn page_no_show_list(
         flashed_messages,
         all_controllers,
         cid_name_name,
+        filtering,
         no_shows
     })?;
     Ok(Html(rendered).into_response())

diff --git a/vzdv-site/templates/admin/no_show_list.jinja b/vzdv-site/templates/admin/no_show_list.jinja
@@ -1,10 +1,10 @@
 {% extends "_layout.jinja" %}
 
-{% block title %}No show list | {{ super() }}{% endblock %}
+{% block title %}No-show list | {{ super() }}{% endblock %}
 
 {% block body %}
 
-<h2 class="pb-3">No show list</h2>
+<h2 class="pb-3">No-show list</h2>
 
 <p>
   This page lists no-show events from students and event controllers to maintain a record for SOP and facility policy adherence.
@@ -31,8 +31,12 @@
         <label for="entry_type">Type (event or training)</label>
         <select name="entry_type" id="entry_type" class="form-control" required>
           <option selected disabled>Type</option>
-          <option value="event">Event</option>
-          <option value="training">Training</option>
+          {% if user_info.is_event_staff %}
+            <option value="event">Event</option>
+          {% endif %}
+          {% if user_info.is_training_staff %}
+            <option value="training">Training</option>
+          {% endif %}
         </select>
       </div>
     </div>
@@ -51,6 +55,7 @@
 
 <hr>
 
+<p class="mb-0">Showing: {{ filtering }} no-shows</p>
 <table class="table table-striped table-hover sortable">
   <thead>
     <tr>

diff --git a/vzdv-site/templates/changelog.jinja b/vzdv-site/templates/changelog.jinja
@@ -24,6 +24,7 @@
         <li>Restore "solo" option in controller certification dropdown for training staff</li>
         <li>"Solo" controller certifications are reset to "training" if a solo cert expires</li>
         <li>New page for training event and training no-shows</li>
+        <li>No-show page is now permissions filtered to differentiate between event and training staff</li>
       </ul>
     </div>
   </div>

diff --git a/vzdv/src/sql.rs b/vzdv/src/sql.rs
@@ -156,7 +156,7 @@ pub struct SoloCert {
     pub expiration_date: DateTime<Utc>,
 }
 
-#[derive(Debug, FromRow, Serialize)]
+#[derive(Debug, Clone, FromRow, Serialize)]
 pub struct NoShow {
     pub id: u32,
     pub cid: u32,