init_richi/schichtplanung
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: Add event co-managers permissions and allow managers/admins to signup guests on skill-restricted shifts

Browse Source
This commit is contained in:
Richard
2026-07-31 11:06:47 +02:00
parent 821e14fcab
commit e2b311b634
23 changed files with 589 additions and 485 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/apps/events/views.py
+129 -114
View File
@@ -29,31 +29,19 @@ class IsAdminOrEventCreator(permissions.BasePermission):
def has_object_permission(self, request, view, obj):
if request.method in permissions.SAFE_METHODS:
return True
if not request.user or not request.user.is_authenticated:
return False
if request.user.is_admin_user or request.user.is_staff or request.user.is_superuser:
return True
return obj.created_by == request.user
return obj.is_user_manager_or_admin(request.user)
class IsTaskAreaOwnerOrAdmin(permissions.BasePermission):
def has_object_permission(self, request, view, obj):
if request.method in permissions.SAFE_METHODS:
return True
if not request.user or not request.user.is_authenticated:
return False
if request.user.is_admin_user or request.user.is_staff or request.user.is_superuser:
return True
return obj.event.created_by == request.user
return obj.event.is_user_manager_or_admin(request.user)
class IsShiftOwnerOrAdmin(permissions.BasePermission):
def has_object_permission(self, request, view, obj):
if request.method in permissions.SAFE_METHODS:
return True
if not request.user or not request.user.is_authenticated:
return False
if request.user.is_admin_user or request.user.is_staff or request.user.is_superuser:
return True
return obj.task_area.event.created_by == request.user
return obj.task_area.event.is_user_manager_or_admin(request.user)
class EventViewSet(viewsets.ModelViewSet):
serializer_class = EventSerializer
@@ -64,7 +52,7 @@ class EventViewSet(viewsets.ModelViewSet):
if user.is_authenticated and (user.is_admin_user or user.is_staff or user.is_superuser):
return Event.objects.all().order_by('-start_date', '-id')
if user.is_authenticated:
return Event.objects.filter(Q(is_active=True) | Q(created_by=user)).order_by('-start_date', '-id')
return Event.objects.filter(Q(is_active=True) | Q(created_by=user) | Q(co_managers=user)).distinct().order_by('-start_date', '-id')
return Event.objects.filter(is_active=True).order_by('-start_date', '-id')
def perform_create(self, serializer):
@@ -73,110 +61,128 @@ class EventViewSet(viewsets.ModelViewSet):
@action(detail=True, methods=['get'])
def matrix(self, request, pk=None):
event = self.get_object()
serializer = EventSerializer(event, context={'request': request})
return Response(serializer.data)
task_areas = event.task_areas.prefetch_related('shifts__required_skills', 'shifts__signups__user').all()
serializer = TaskAreaSerializer(task_areas, many=True, context={'request': request})
@action(detail=True, methods=['post'], permission_classes=[permissions.IsAuthenticated])
def save_as_template(self, request, pk=None):
event = self.get_object()
name = request.data.get('name', f"Vorlage von {event.title}")
description = request.data.get('description', '')
user_signups = []
if request.user.is_authenticated:
signups = ShiftSignup.objects.filter(shift__task_area__event=event, user=request.user)
user_signups = list(signups.values_list('shift_id', flat=True))
# Build template structure
template_task_areas = []
for ta in event.task_areas.all():
shifts_data = []
for shift in ta.shifts.all():
shifts_data.append({
'title': shift.title,
'start_time': shift.start_time,
'end_time': shift.end_time,
'max_participants': shift.max_participants,
'required_skill_names': list(shift.required_skills.values_list('name', flat=True))
})
template_task_areas.append({
'name': ta.name,
'description': ta.description,
'order': ta.order,
'shifts': shifts_data
})
template = EventTemplate.objects.create(
name=name,
description=description,
template_data={'task_areas': template_task_areas},
created_by=request.user
)
return Response(EventTemplateSerializer(template).data, status=status.HTTP_201_CREATED)
return Response({
'event': EventSerializer(event).data,
'task_areas': serializer.data,
'user_signups': user_signups
})
@action(detail=True, methods=['get'])
def export_pdf(self, request, pk=None):
def pdf(self, request, pk=None):
event = self.get_object()
task_areas = event.task_areas.prefetch_related('shifts__required_skills', 'shifts__signups__user').all()
buffer = BytesIO()
doc = SimpleDocTemplate(
buffer, pagesize=landscape(letter),
rightMargin=30, leftMargin=30, topMargin=30, bottomMargin=30
buffer,
pagesize=landscape(letter),
rightMargin=30,
leftMargin=30,
topMargin=30,
bottomMargin=30
)
elements = []
styles = getSampleStyleSheet()
title_style = ParagraphStyle(
'DocTitle',
'EventTitle',
parent=styles['Heading1'],
fontSize=20,
leading=24,
textColor=colors.HexColor('#1e293b'),
fontSize=18,
leading=22,
textColor=colors.HexColor('#0f172a'),
spaceAfter=6
)
sub_style = ParagraphStyle(
'DocSub',
subtitle_style = ParagraphStyle(
'EventSubtitle',
parent=styles['Normal'],
fontSize=10,
leading=12,
textColor=colors.HexColor('#64748b'),
leading=14,
textColor=colors.HexColor('#475569'),
spaceAfter=15
)
cell_title_style = ParagraphStyle(
'CellTitle',
parent=styles['Normal'],
fontSize=9,
leading=11,
textColor=colors.HexColor('#0f172a'),
fontName='Helvetica-Bold'
)
cell_text_style = ParagraphStyle(
'CellText',
parent=styles['Normal'],
fontSize=8,
leading=10,
textColor=colors.HexColor('#334155')
)
elements.append(Paragraph(f"Schichtplan: {event.title}", title_style))
loc_str = f" • Ort: {event.location}" if event.location else ""
elements.append(Paragraph(f"Zeitraum: {event.start_date} bis {event.end_date}{loc_str}", sub_style))
# Build Table Data
table_data = []
headers = ["Bereich", "Schicht & Zeit", "Benötigte Qualifikationen", "Eingetragene Personen"]
table_data.append([Paragraph(f"<b>{h}</b>", styles['Normal']) for h in headers])
date_str = f"{event.start_date.strftime('%d.%m.%Y')} - {event.end_date.strftime('%d.%m.%Y')}"
loc_str = f" | Ort: {event.location}" if event.location else ""
elements.append(Paragraph(f"Datum: {date_str}{loc_str}", subtitle_style))
for ta in event.task_areas.all():
for shift in ta.shifts.all():
skills_list = ", ".join([s.name for s in shift.required_skills.all()]) or "Keine"
table_data = [[
Paragraph("Aufgabenbereich", cell_title_style),
Paragraph("Schicht", cell_title_style),
Paragraph("Zeitfenster", cell_title_style),
Paragraph("Erforderlich", cell_title_style),
Paragraph("Eingetragene Personen / Plätze", cell_title_style)
]]
signups = shift.signups.all()
signups_list = []
for su in signups:
if request.user.is_authenticated:
display = su.user.get_display_name() if su.user else (su.guest_name or "Gast")
else:
display = "Belegt (Anonym)"
signups_list.append(display)
for area in task_areas:
shifts = area.shifts.all()
if not shifts:
table_data.append([
Paragraph(area.name, cell_title_style),
Paragraph("—", cell_text_style),
Paragraph("—", cell_text_style),
Paragraph("—", cell_text_style),
Paragraph("Keine Schichten definiert", cell_text_style)
])
else:
for idx, shift in enumerate(shifts):
area_name = area.name if idx == 0 else ""
skills_str = ", ".join([s.name for s in shift.required_skills.all()]) or "Keine"
while len(signups_list) < shift.max_participants:
signups_list.append("[ Offen ]")
signups = shift.signups.all()
signup_names = []
for su in signups:
if su.user:
signup_names.append(su.user.get_display_name())
elif su.guest_name:
signup_names.append(f"{su.guest_name} (Gast)")
signups_str = "<br/>".join(signups_list)
needed = shift.max_participants - len(signup_names)
if needed > 0:
signup_names.extend([f"<i>[ {needed} Platz frei ]</i>"] * 1)
row = [
Paragraph(f"<b>{ta.name}</b>", styles['Normal']),
Paragraph(f"{shift.title}<br/><font color='#64748b'>{shift.start_time} - {shift.end_time}</font>", styles['Normal']),
Paragraph(skills_list, styles['Normal']),
Paragraph(signups_str, styles['Normal'])
]
table_data.append(row)
participants_html = "<br/>".join(signup_names) or "<i>[ Frei ]</i>"
if len(table_data) == 1:
table_data.append([Paragraph("Keine Schichten angelegt", styles['Normal']), "", "", ""])
date_prefix = f"{shift.date.strftime('%d.%m.')} " if shift.date else ""
time_range = f"{date_prefix}{shift.start_time} - {shift.end_time} Uhr"
pdf_table = Table(table_data, colWidths=[150, 160, 160, 250])
table_data.append([
Paragraph(area_name, cell_title_style),
Paragraph(shift.title, cell_text_style),
Paragraph(time_range, cell_text_style),
Paragraph(skills_str, cell_text_style),
Paragraph(participants_html, cell_text_style)
])
col_widths = [130, 110, 110, 110, 240]
pdf_table = Table(table_data, colWidths=col_widths, repeatRows=1)
pdf_table.setStyle(TableStyle([
('BACKGROUND', (0, 0), (-1, 0), colors.HexColor('#f1f5f9')),
('TEXTCOLOR', (0, 0), (-1, 0), colors.HexColor('#0f172a')),
@@ -203,9 +209,7 @@ class TaskAreaViewSet(viewsets.ModelViewSet):
def perform_create(self, serializer):
event = serializer.validated_data.get('event')
user = self.request.user
if not user.is_authenticated:
raise permissions.PermissionDenied("Nicht angemeldet.")
if not (user.is_admin_user or user.is_staff or user.is_superuser or (event and event.created_by == user)):
if not event or not event.is_user_manager_or_admin(user):
raise permissions.PermissionDenied("Keine Berechtigung, Bereiche für dieses Event hinzuzufügen.")
serializer.save()
@@ -217,9 +221,7 @@ class ShiftViewSet(viewsets.ModelViewSet):
def perform_create(self, serializer):
task_area = serializer.validated_data.get('task_area')
user = self.request.user
if not user.is_authenticated:
raise permissions.PermissionDenied("Nicht angemeldet.")
if not (user.is_admin_user or user.is_staff or user.is_superuser or (task_area and task_area.event.created_by == user)):
if not task_area or not task_area.event.is_user_manager_or_admin(user):
raise permissions.PermissionDenied("Keine Berechtigung, Schichten für dieses Event hinzuzufügen.")
serializer.save()
@@ -228,19 +230,36 @@ class ShiftSignupView(views.APIView):
def post(self, request, shift_id):
shift = get_object_or_404(Shift, pk=shift_id)
event = shift.task_area.event
user = request.user if request.user.is_authenticated else None
is_manager = event.is_user_manager_or_admin(user)
# Check capacity
if shift.signups.count() >= shift.max_participants:
return Response({'error': 'Diese Schicht ist bereits vollständig belegt.'}, status=status.HTTP_400_BAD_REQUEST)
# Authenticated User flow
if request.user.is_authenticated:
if ShiftSignup.objects.filter(shift=shift, user=request.user).exists():
guest_name = request.data.get('guest_name', '').strip()
# Manager/Owner/Admin registering a guest manually -> Skill check bypassed!
if is_manager and guest_name:
signup = ShiftSignup.objects.create(
shift=shift,
guest_name=guest_name,
guest_session_key='added_by_manager'
)
return Response({
'message': f'Gast "{guest_name}" wurde von dir erfolgreich eingetragen (ohne Qualifikationsprüfung).',
'signup_id': signup.id
}, status=status.HTTP_201_CREATED)
# Authenticated User flow (self-signup)
if user and not guest_name:
if ShiftSignup.objects.filter(shift=shift, user=user).exists():
return Response({'error': 'Du bist für diese Schicht bereits eingetragen.'}, status=status.HTTP_400_BAD_REQUEST)
required_skills = shift.required_skills.all()
if required_skills.exists():
user_skills = request.user.skills.all()
user_skills = user.skills.all()
missing_skills = [s.name for s in required_skills if s not in user_skills]
if missing_skills:
missing_str = ", ".join(missing_skills)
@@ -248,21 +267,20 @@ class ShiftSignupView(views.APIView):
'error': f'Dir fehlen folgende erforderliche Fähigkeiten für diese Schicht: {missing_str}'
}, status=status.HTTP_400_BAD_REQUEST)
signup = ShiftSignup.objects.create(shift=shift, user=request.user)
signup = ShiftSignup.objects.create(shift=shift, user=user)
return Response({'message': 'Erfolgreich für Schicht eingetragen.', 'signup_id': signup.id}, status=status.HTTP_201_CREATED)
# Guest flow
# Guest flow for visitors
else:
guest_name = request.data.get('guest_name', '').strip()
captcha_token = request.data.get('captcha_token', '').strip()
if not guest_name:
return Response({'error': 'Bitte gib einen Namen an.'}, status=status.HTTP_400_BAD_REQUEST)
if not captcha_token:
captcha_token = request.data.get('captcha_token', '').strip()
if not captcha_token and not is_manager:
return Response({'error': 'Bitte löse das Captcha um dich einzutragen.'}, status=status.HTTP_400_BAD_REQUEST)
if shift.required_skills.exists():
# If NOT a manager, enforce required skills check for guest signups
if not is_manager and shift.required_skills.exists():
required_names = ", ".join([s.name for s in shift.required_skills.all()])
return Response({
'error': f'Gäste können keine Fähigkeiten haben. Diese Schicht erfordert: {required_names}. Bitte registriere ein Konto mit den passenden Fähigkeiten.'
@@ -282,7 +300,7 @@ class ShiftSignupView(views.APIView):
guest_session_key=session_key
)
return Response({
'message': 'Als Gast erfolgreich eingetragen! Dein Name wurde in deiner Sitzung gespeichert.',
'message': f'Gast "{guest_name}" erfolgreich eingetragen!',
'signup_id': signup.id
}, status=status.HTTP_201_CREATED)
@@ -300,7 +318,7 @@ class ShiftSignupView(views.APIView):
if request.user.is_authenticated:
user = request.user
is_manager = user.is_admin_user or user.is_staff or user.is_superuser or (shift.task_area.event.created_by == user)
is_manager = shift.task_area.event.is_user_manager_or_admin(user)
if signup_id and is_manager:
signup = ShiftSignup.objects.filter(shift=shift, pk=signup_id).first()
@@ -344,9 +362,6 @@ class EventTemplateViewSet(viewsets.ModelViewSet):
end_date = request.data.get('end_date')
location = request.data.get('location', '')
if not start_date or not end_date:
return Response({'error': 'start_date und end_date sind erforderlich.'}, status=status.HTTP_400_BAD_REQUEST)
event = Event.objects.create(
title=title,
description=template.description,