feat: Add event co-managers permissions and allow managers/admins to signup guests on skill-restricted shifts

2026-07-31 11:06:47 +02:00
parent 821e14fcab
commit e2b311b634
23 changed files with 589 additions and 485 deletions
@@ -111,3 +111,34 @@ class EventAndShiftTests(TestCase):
        res_ok = self.client.delete(f'/api/shifts/{shift.id}/signup/', {'signup_id': signup.id}, format='json')
        self.assertEqual(res_ok.status_code, status.HTTP_200_OK)
        self.assertFalse(ShiftSignup.objects.filter(pk=signup.id).exists())
+
+    def test_co_manager_permissions_and_guest_skill_bypass(self):
+        owner = User.objects.create_user(username="owner_user", email="owner@test.de", password="password123")
+        co_manager = User.objects.create_user(username="comanager", email="comanager@test.de", password="password123")
+        
+        event = Event.objects.create(title="CoManaged Event", start_date="2026-10-01", end_date="2026-10-02", created_by=owner)
+        event.co_managers.add(co_manager)
+        
+        ta = TaskArea.objects.create(event=event, name="Einlass")
+        shift = Shift.objects.create(task_area=ta, title="Spätschicht", start_time="20:00", end_time="24:00", max_participants=5)
+        shift.required_skills.add(self.skill)
+
+        # Co-manager can edit event
+        self.client.force_authenticate(user=co_manager)
+        res_edit = self.client.patch(f'/api/events/{event.id}/', {'location': 'Haupteingang'})
+        self.assertEqual(res_edit.status_code, status.HTTP_200_OK)
+        self.assertEqual(res_edit.data['location'], 'Haupteingang')
+
+        # Co-manager CAN register a guest on skill-required shift (skill check bypassed for manager!)
+        res_guest = self.client.post(f'/api/shifts/{shift.id}/signup/', {'guest_name': 'VIP Gast'}, format='json')
+        self.assertEqual(res_guest.status_code, status.HTTP_201_CREATED)
+        self.assertIn('ohne Qualifikationsprüfung', res_guest.data['message'])
+
+        # Check signup exists
+        signup_id = res_guest.data['signup_id']
+        signup = ShiftSignup.objects.get(pk=signup_id)
+        self.assertEqual(signup.guest_name, 'VIP Gast')
+
+        # Co-manager can delete any signup
+        res_del = self.client.delete(f'/api/shifts/{shift.id}/signup/', {'signup_id': signup_id}, format='json')
+        self.assertEqual(res_del.status_code, status.HTTP_200_OK)