from django.contrib.auth.mixins import UserPassesTestMixin from django.urls import reverse_lazy from django.views import generic from ..forms import ItemCreateForm from ..models import GroupedOrder, Item class ItemCreateView(UserPassesTestMixin, generic.CreateView): """CreateView for an item""" model = Item form_class = ItemCreateForm def get_form_kwargs(self): kwargs = super().get_form_kwargs() kwargs["grouped_order"] = GroupedOrder.objects.get(id=self.kwargs.get("pk")) return kwargs def test_func(self): """Accessible only if the requesting user is the grouped order organizer""" grouped_order_id = self.kwargs.get("pk") return GroupedOrder.objects.get(pk=grouped_order_id).orga == self.request.user class ItemDeleteView(UserPassesTestMixin, generic.DeleteView): """DeleteView for an item The form does a GET to this view - it displays a confirmation page - then we post this view """ model = Item def get_success_url(self): return reverse_lazy("order:manage_items", args=[self.object.grouped_order.id]) def test_func(self): """Accessible only if the requesting user is the grouped order organizer""" return self.get_object().grouped_order.orga == self.request.user