Repository navigation
Feat/EAP visibility - #2860
Merged
Merged
Feat/EAP visibility#2860
Conversation
susilnem
force-pushed
the
feature/eap-visibilty
branch
from
October 8, 2026 04:44
7316680 to
1269e7d
Compare
- Scope EAP querysets so a user only sees the EAPs they created, that were shared with them, or that belong to a National Society or region they administer; superusers and IFRC admins are unrestricted, as in Dref - Applied to the EAPRegistration, SimplifiedEAP, FullEAP, EAPShareUser and ActiveEAP viewsets, so out-of-scope objects return 404 instead of 403 - Allow the creator and shared users to update an EAP, not only country and region admins - Guard application create: has_object_permission is never called on create, so POST /simplified-eap/ and /full-eap/ were open to any logged-in user, and creating an application locks the registration - Order the m2m assertions in test_snapshot_full_eap
…ions - Under Development -> Under Review had no permission check, while NS Addressing Comments -> Under Review checked country admin, IFRC admin and creator-or-shared. A region admin who had not created the EAP could therefore submit it but not resubmit it after IFRC comments - Add has_submit_permission and use it for both, so submitting is open to the same people who can edit the EAP: the National Society's admins, its region's admins, the creator and the shared users
susilnem
force-pushed
the
feature/eap-visibilty
branch
from
October 12, 2026 05:12
1269e7d to
099cdf7
Compare
susilnem
marked this pull request as ready for review
October 13, 2026 04:10
Member
Author
|
@szabozoltan69 , Can you also merge this pull request and deploy on staging? |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Changes
shared with them, or that belong to a National Society or region they
administer; superusers and IFRC admins are unrestricted, as in Dref
ActiveEAP viewsets, so out-of-scope objects return 404 instead of 403
region admins
Checklist
Things that should succeed before merging.
Release
If there is a version update, make sure to tag the repository with the latest version.