diff --git a/rero_ils/modules/ill_requests/views.py b/rero_ils/modules/ill_requests/views.py
index 0f4e446e05..309a4ba9ca 100644
--- a/rero_ils/modules/ill_requests/views.py
+++ b/rero_ils/modules/ill_requests/views.py
@@ -35,16 +35,16 @@
blueprint = Blueprint(
'ill_requests',
__name__,
- url_prefix='/ill_requests',
+ url_prefix='/
',
template_folder='templates',
static_folder='static',
)
-@blueprint.route('/create/', methods=['GET', 'POST'])
+@blueprint.route('/ill_requests/new', methods=['GET', 'POST'])
@check_user_is_authenticated(redirect_to='security.login')
@check_logged_as_patron
-def ill_request_form():
+def ill_request_form(viewcode):
"""Return professional view."""
form = ILLRequestForm(request.form)
# pickup locations selection are based on app context then the choices
@@ -58,7 +58,7 @@ def ill_request_form():
ill_request_data['pickup_location'])
# get the patron account of the same org of the location pid
- def get_patron(location_pid):
+ def get_patron(loc_pid):
loc = Location.get_record_by_pid(loc_pid)
for ptrn in current_patrons:
if ptrn.organisation_pid == loc.organisation_pid:
@@ -73,6 +73,7 @@ def get_patron(location_pid):
_('The request has been transmitted to your library.'),
'success'
)
- return redirect(url_for('patrons.profile', tab='ill_request'))
+ return redirect(url_for('patrons.profile', viewcode=viewcode))
- return render_template('rero_ils/ill_request_form.html', form=form)
+ return render_template('rero_ils/ill_request_form.html',
+ form=form, viewcode=viewcode)
diff --git a/rero_ils/modules/patrons/templates/rero_ils/patron_profile.html b/rero_ils/modules/patrons/templates/rero_ils/patron_profile.html
index dde9590ac7..6186b1aeac 100644
--- a/rero_ils/modules/patrons/templates/rero_ils/patron_profile.html
+++ b/rero_ils/modules/patrons/templates/rero_ils/patron_profile.html
@@ -24,10 +24,11 @@
{%- endblock css %}
{%- block body %}
-
+
{%- endblock body %}
{%- block javascript %}
-{{ super() }}
-{{ node_assets('@rero/rero-ils-ui/dist/public-patron-profile', tags='defer') }}
+{{ webpack['reroils_public.js']}}
+{{ node_assets('@rero/rero-ils-ui/dist/public-patron-profile', patterns=['polyfills-es5*.js','main-es5*.js'], tags='nomodule defer') }}
+{{ node_assets('@rero/rero-ils-ui/dist/public-patron-profile', patterns=['polyfills-es2015*.js','main-es2015*.js'], tags='type="module"') }}
{%- endblock javascript %}
diff --git a/rero_ils/modules/patrons/views.py b/rero_ils/modules/patrons/views.py
index 0b889e2a1e..c8277b9fbc 100644
--- a/rero_ils/modules/patrons/views.py
+++ b/rero_ils/modules/patrons/views.py
@@ -130,7 +130,13 @@ def logged_user():
),
'librarianRoles': current_app.config.get(
'RERO_ILS_LIBRARIAN_ROLES', []
- )
+ ),
+ 'userProfile': {
+ 'readOnly': current_app.config.get(
+ 'RERO_PUBLIC_USERPROFILES_READONLY', False),
+ 'readOnlyFields': current_app.config.get(
+ 'RERO_PUBLIC_USERPROFILES_READONLY_FIELDS', []),
+ }
}
}
if not current_user.is_authenticated:
@@ -138,9 +144,7 @@ def logged_user():
user = User.get_by_id(current_user.id).dumpsMetadata()
user['id'] = current_user.id
- data = {**data, **user}
- data['patrons'] = []
-
+ data = {**data, **user, 'patrons': []}
for patron in Patron.get_patrons_by_user(current_user):
organisation = patron.get_organisation()
# TODO: need to be fixed this causes errors in production only
@@ -168,9 +172,7 @@ def logged_user():
return jsonify(data)
-@blueprint.route('/global/patrons/profile', defaults={'viewcode': 'global'},
- methods=['GET', 'POST'])
-@blueprint.route('//patrons/profile')
+@blueprint.route('//patrons/profile', methods=['GET', 'POST'])
@check_logged_as_patron
@register_menu(
blueprint,
@@ -185,7 +187,7 @@ def logged_user():
)
def profile(viewcode):
"""Patron Profile Page."""
- return render_template('rero_ils/patron_profile.html')
+ return render_template('rero_ils/patron_profile.html', viewcode=viewcode)
@blueprint.app_template_filter('format_currency')
diff --git a/rero_ils/modules/users/api.py b/rero_ils/modules/users/api.py
index 68914ad37a..0f1f9d127e 100644
--- a/rero_ils/modules/users/api.py
+++ b/rero_ils/modules/users/api.py
@@ -69,6 +69,11 @@ def __init__(self, user):
"""User class initializer."""
self.user = user
+ @property
+ def id(self):
+ """Get user id."""
+ return self.user.id
+
@classmethod
def create(cls, data, **kwargs):
"""User record creation.
diff --git a/rero_ils/modules/users/templates/rero_ils/user_password.html b/rero_ils/modules/users/templates/rero_ils/user_password.html
new file mode 100644
index 0000000000..e106e00c40
--- /dev/null
+++ b/rero_ils/modules/users/templates/rero_ils/user_password.html
@@ -0,0 +1,30 @@
+{# -*- coding: utf-8 -*-
+
+ RERO ILS
+ Copyright (C) 2022 RERO
+
+ This program is free software: you can redistribute it and/or modify
+ it under the terms of the GNU Affero General Public License as published by
+ the Free Software Foundation, version 3 of the License.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU Affero General Public License for more details.
+
+ You should have received a copy of the GNU Affero General Public License
+ along with this program. If not, see .
+
+#}
+{% extends 'rero_ils/page.html' %}
+
+{%- block body %}
+{{ _('Change password') }}
+
+{%- endblock body %}
+
+{%- block javascript %}
+{{ webpack['reroils_public.js']}}
+{{ node_assets('@rero/rero-ils-ui/dist/public-user-password-change', patterns=['polyfills-es5*.js','main-es5*.js'], tags='nomodule defer') }}
+{{ node_assets('@rero/rero-ils-ui/dist/public-user-password-change', patterns=['polyfills-es2015*.js','main-es2015*.js'], tags='type="module"') }}
+{%- endblock javascript %}
diff --git a/rero_ils/modules/users/templates/rero_ils/user_profile.html b/rero_ils/modules/users/templates/rero_ils/user_profile.html
new file mode 100644
index 0000000000..e76739dd5e
--- /dev/null
+++ b/rero_ils/modules/users/templates/rero_ils/user_profile.html
@@ -0,0 +1,30 @@
+{# -*- coding: utf-8 -*-
+
+ RERO ILS
+ Copyright (C) 2022 RERO
+
+ This program is free software: you can redistribute it and/or modify
+ it under the terms of the GNU Affero General Public License as published by
+ the Free Software Foundation, version 3 of the License.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU Affero General Public License for more details.
+
+ You should have received a copy of the GNU Affero General Public License
+ along with this program. If not, see .
+
+#}
+{% extends 'rero_ils/page.html' %}
+
+{%- block body %}
+{{ _('Profile') }}
+
+{%- endblock body %}
+
+{%- block javascript %}
+{{ webpack['reroils_public.js']}}
+{{ node_assets('@rero/rero-ils-ui/dist/public-user-profile-edit', patterns=['polyfills-es5*.js','main-es5*.js'], tags='nomodule defer') }}
+{{ node_assets('@rero/rero-ils-ui/dist/public-user-profile-edit', patterns=['polyfills-es2015*.js','main-es2015*.js'], tags='type="module"') }}
+{%- endblock javascript %}
diff --git a/rero_ils/modules/users/views.py b/rero_ils/modules/users/views.py
index 97824d220a..23bb3e97c2 100644
--- a/rero_ils/modules/users/views.py
+++ b/rero_ils/modules/users/views.py
@@ -22,10 +22,12 @@
import json
from functools import wraps
-from flask import request
+from flask import Blueprint, abort, current_app, render_template, request
+from flask_login import current_user
from invenio_rest import ContentNegotiatedMethodView
from .api import User
+from ...modules.patrons.api import current_librarian
from ...permissions import login_and_librarian
@@ -42,6 +44,40 @@ def is_logged_librarian(*args, **kwargs):
return is_logged_librarian
+def check_user_permission(fn):
+ """Decorate to check permission access.
+
+ The access is allow when the connected user is a librarian or
+ the user id is the same of the id argument.
+ """
+ @wraps(fn)
+ def is_logged(*args, **kwargs):
+ """Decorated view."""
+ if not current_user.is_authenticated:
+ abort(401)
+ if not current_librarian and 'id' in kwargs \
+ and current_user.id != int(kwargs.get('id')):
+ abort(401)
+ return fn(*args, **kwargs)
+ return is_logged
+
+
+def check_user_readonly_permission(fn):
+ """Decorate to check permission access.
+
+ The access is allow when the connected user and the profile is not in
+ readonly.
+ """
+ @wraps(fn)
+ def is_user_readonly(*args, **kwargs):
+ """Decorated view."""
+ if current_app.config.get('RERO_PUBLIC_USERPROFILES_READONLY', False) \
+ or not current_user.is_authenticated:
+ abort(401)
+ return fn(*args, **kwargs)
+ return is_user_readonly
+
+
class UsersResource(ContentNegotiatedMethodView):
"""User REST resource."""
@@ -67,13 +103,13 @@ def __init__(self, **kwargs):
**kwargs
)
- @check_permission
+ @check_user_permission
def get(self, id):
"""Implement the GET."""
user = User.get_by_id(id)
return user.dumps()
- @check_permission
+ @check_user_permission
def put(self, id):
"""Implement the PUT."""
user = User.get_by_id(id)
@@ -106,7 +142,7 @@ def __init__(self, **kwargs):
**kwargs
)
- @check_permission
+ @check_user_permission
def get(self):
"""Get user info for the professionnal view."""
email_or_username = request.args.get('q', None).strip()
@@ -131,7 +167,9 @@ def get(self):
user = User.get_by_username_or_email(email_or_username)
if not user:
return hits
- data = user.dumps()
+ # if librarian: send all user data
+ # if patron: send only the user id
+ data = user.dumps() if current_librarian else {'id': user.id}
hits['hits']['hits'].append(data)
hits['hits']['total']['value'] = 1
return hits
@@ -141,3 +179,28 @@ def post(self):
"""Implement the POST."""
user = User.create(request.get_json())
return user.dumps()
+
+
+blueprint = Blueprint(
+ 'users',
+ __name__,
+ template_folder='templates',
+ static_folder='static',
+)
+
+
+@blueprint.route('//user/profile')
+@check_user_readonly_permission
+def profile(viewcode):
+ """User Profile editor Page."""
+ return render_template('rero_ils/user_profile.html',
+ viewcode=viewcode)
+
+
+@blueprint.route('//user/password')
+@check_user_readonly_permission
+def password(viewcode):
+ """User change password Page."""
+ return render_template('rero_ils/user_password.html',
+ viewcode=viewcode,
+ current_user=current_user)
diff --git a/rero_ils/theme/menus.py b/rero_ils/theme/menus.py
index cd08f57419..e6c3d37580 100644
--- a/rero_ils/theme/menus.py
+++ b/rero_ils/theme/menus.py
@@ -128,6 +128,10 @@ def init_menu_tools():
rero_register(
item,
endpoint='ill_requests.ill_request_form',
+ endpoint_arguments_constructor=lambda: dict(
+ viewcode=request.view_args.get(
+ 'viewcode', current_app.config.get(
+ 'RERO_ILS_SEARCH_GLOBAL_VIEW_CODE'))),
visible_when=lambda: bool(current_patrons),
text=TextWithIcon(
icon='',
@@ -309,6 +313,10 @@ def init_menu_profile():
rero_register(
item,
endpoint=profile_endpoint,
+ endpoint_arguments_constructor=lambda: dict(
+ viewcode=request.view_args.get(
+ 'viewcode', current_app.config.get(
+ 'RERO_ILS_SEARCH_GLOBAL_VIEW_CODE'))),
visible_when=lambda: len(current_patrons) > 0,
text=TextWithIcon(
icon='',
@@ -321,8 +329,14 @@ def init_menu_profile():
item = current_menu.submenu('main.profile.edit_profile')
rero_register(
item,
- endpoint='invenio_userprofiles.profile',
- visible_when=lambda: current_user.is_authenticated,
+ endpoint='users.profile',
+ endpoint_arguments_constructor=lambda: dict(
+ viewcode=request.view_args.get(
+ 'viewcode', current_app.config.get(
+ 'RERO_ILS_SEARCH_GLOBAL_VIEW_CODE'))),
+ visible_when=lambda: not current_app.config.get(
+ 'RERO_PUBLIC_USERPROFILES_READONLY', False) and
+ current_user.is_authenticated,
text=TextWithIcon(
icon='',
text='Edit my profile'
@@ -334,8 +348,14 @@ def init_menu_profile():
item = current_menu.submenu('main.profile.change_password')
rero_register(
item,
- endpoint='security.change_password',
- visible_when=lambda: current_user.is_authenticated,
+ endpoint='users.password',
+ endpoint_arguments_constructor=lambda: dict(
+ viewcode=request.view_args.get(
+ 'viewcode', current_app.config.get(
+ 'RERO_ILS_SEARCH_GLOBAL_VIEW_CODE'))),
+ visible_when=lambda: not current_app.config.get(
+ 'RERO_PUBLIC_USERPROFILES_READONLY', False) and
+ current_user.is_authenticated,
text=TextWithIcon(
icon='',
text='Change password'
@@ -347,12 +367,13 @@ def init_menu_profile():
# Endpoint for:
# Application: invenio_oauth2server_settings.index
# Security: invenio_accounts.security
-
item = current_menu.submenu('main.profile.signup')
rero_register(
item,
endpoint='security.register',
- visible_when=lambda: not current_user.is_authenticated,
+ visible_when=lambda: not current_app.config.get(
+ 'RERO_PUBLIC_USERPROFILES_READONLY', False)
+ and not current_user.is_authenticated,
text=TextWithIcon(
icon='',
text='Sign Up'
diff --git a/setup.py b/setup.py
index 2480f408a8..49a7f1bb3d 100644
--- a/setup.py
+++ b/setup.py
@@ -98,6 +98,7 @@ def run(self):
'rero_ils = rero_ils.theme.views:blueprint',
'stats = rero_ils.modules.stats.views:blueprint',
'templates = rero_ils.modules.templates.views:blueprint',
+ 'users = rero_ils.modules.users.views:blueprint',
],
'invenio_base.api_blueprints': [
'acq_accounts = rero_ils.modules.acq_accounts.views:api_blueprint',
diff --git a/tests/api/users/test_users_rest.py b/tests/api/users/test_users_rest.py
index 3c317625fa..bd7640047f 100644
--- a/tests/api/users/test_users_rest.py
+++ b/tests/api/users/test_users_rest.py
@@ -148,7 +148,8 @@ def test_users_search_api(client, librarian_martigny, patron_martigny):
)
assert res.status_code == 200
hits = get_json(res)
- assert hits['hits']['hits'][0]['id'] == patron_martigny['user_id']
+ assert hits['hits']['hits'][0]['metadata']['username'] == \
+ patron_martigny['username']
assert hits['hits']['total']['value'] == 1
# all by email
@@ -160,7 +161,8 @@ def test_users_search_api(client, librarian_martigny, patron_martigny):
)
assert res.status_code == 200
hits = get_json(res)
- assert hits['hits']['hits'][0]['id'] == patron_martigny['user_id']
+ assert hits['hits']['hits'][0]['metadata']['username'] == \
+ patron_martigny['username']
assert hits['hits']['total']['value'] == 1
# by username
@@ -172,7 +174,8 @@ def test_users_search_api(client, librarian_martigny, patron_martigny):
)
assert res.status_code == 200
hits = get_json(res)
- assert hits['hits']['hits'][0]['id'] == patron_martigny['user_id']
+ assert hits['hits']['hits'][0]['metadata']['username'] == \
+ patron_martigny['username']
assert hits['hits']['total']['value'] == 1
# by email
@@ -184,7 +187,8 @@ def test_users_search_api(client, librarian_martigny, patron_martigny):
)
assert res.status_code == 200
hits = get_json(res)
- assert hits['hits']['hits'][0]['id'] == patron_martigny['user_id']
+ assert hits['hits']['hits'][0]['metadata']['username'] == \
+ patron_martigny['username']
assert hits['hits']['total']['value'] == 1
# by uppercase email
@@ -196,5 +200,19 @@ def test_users_search_api(client, librarian_martigny, patron_martigny):
)
assert res.status_code == 200
hits = get_json(res)
- assert hits['hits']['hits'][0]['id'] == patron_martigny['user_id']
+ assert hits['hits']['hits'][0]['metadata']['username'] == \
+ patron_martigny['username']
assert hits['hits']['total']['value'] == 1
+
+ # Login with patron role
+ login_user_via_session(client, p_martigny.user)
+ res = client.get(
+ url_for(
+ 'api_users.users_list',
+ q=patron_martigny['username']
+ )
+ )
+ assert res.status_code == 200
+ hits = get_json(res)
+ assert 'metadata' not in hits['hits']['hits'][0]
+ assert hits['hits']['hits'][0]['id'] == patron_martigny['user_id']
diff --git a/tests/ui/ill_requests/test_ill_requests_ui.py b/tests/ui/ill_requests/test_ill_requests_ui.py
index c09232fa97..4474f220f7 100644
--- a/tests/ui/ill_requests/test_ill_requests_ui.py
+++ b/tests/ui/ill_requests/test_ill_requests_ui.py
@@ -29,7 +29,8 @@ def test_ill_request_create_request_form(client, app,
loc_public_martigny,
patron_martigny):
""" test ill request create form."""
- request_form_url = url_for('ill_requests.ill_request_form')
+ request_form_url = url_for(
+ 'ill_requests.ill_request_form', viewcode='global')
# Not logged user don't have access to request_form. It is redirected to
# login form
diff --git a/tests/ui/users/test_users_ui.py b/tests/ui/users/test_users_ui.py
new file mode 100644
index 0000000000..00aa6c41ed
--- /dev/null
+++ b/tests/ui/users/test_users_ui.py
@@ -0,0 +1,54 @@
+# -*- coding: utf-8 -*-
+#
+# RERO ILS
+# Copyright (C) 2019 RERO
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, version 3 of the License.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program. If not, see .
+
+"""Tests UI view for users."""
+
+from flask import url_for
+from invenio_accounts.testutils import login_user_via_session
+
+
+def test_users_not_authorized_access(client):
+ """Test profile or change password if the user is not logged."""
+
+ res = client.get(url_for('users.profile', viewcode='global'))
+ assert res.status_code == 401
+
+ res = client.get(url_for('users.password', viewcode='global'))
+ assert res.status_code == 401
+
+
+def test_users_authorized_access(client, patron_martigny):
+ """Test profile and change password if the user is logged."""
+
+ login_user_via_session(client, patron_martigny.user)
+ res = client.get(url_for('users.profile', viewcode='global'))
+ assert res.status_code == 200
+
+ res = client.get(url_for('users.password', viewcode='global'))
+ assert res.status_code == 200
+
+
+def test_users_readonly_not_authorized_access(app, client, patron_martigny):
+ """Test profile and change password with readonly config."""
+
+ app.config['RERO_PUBLIC_USERPROFILES_READONLY'] = True
+ login_user_via_session(client, patron_martigny.user)
+ res = client.get(url_for('users.profile', viewcode='global'))
+ assert res.status_code == 401
+
+ res = client.get(url_for('users.password', viewcode='global'))
+ assert res.status_code == 401