This commit is contained in:
zandercymatics 2024-05-20 12:42:34 -06:00
parent c085512c70
commit 364e38792c
No known key found for this signature in database
GPG key ID: FF4636ABEC9682B7
6 changed files with 37 additions and 73 deletions

View file

@ -85,7 +85,6 @@ def login_callback(request):
"""Analyze the token returned by the authentication provider (OP)."""
global CLIENT
try:
request.session["is_new_user"] = False
# If the CLIENT is none, attempt to reinitialize before handling the request
if _client_is_none():
logger.debug("OIDC client is None, attempting to initialize")
@ -135,7 +134,7 @@ def login_callback(request):
def _set_authenticated_user_metadata(user, is_new_user):
"""Does checks on the recieved authenticated user from login_callback,
and updates fields accordingly. U"""
and updates fields accordingly."""
should_update_user = False
# Fixture users kind of exist in a superposition of verification types,
# because while the system "verified" them, if they login,

View file

@ -879,10 +879,10 @@ function hideDeletedForms() {
}
if (inputField) {
// Remove the "full_name" field
// Hide the "full_name" field
inputFieldParentDiv = inputField.closest("div");
if (inputFieldParentDiv) {
inputFieldParentDiv.remove();
inputFieldParentDiv.classList.add("display-none");
}
}
}
@ -926,30 +926,25 @@ function hideDeletedForms() {
if (fieldIdParts && fieldIdParts.length > 0){
let fieldName = fieldIdParts[0]
// Check if an error message exists for the given field
let errorMessage = document.querySelector(`#id_${fieldName}__error-message`);
if (errorMessage) {
let nameFields = ["first_name", "middle_name", "last_name"]
// Show the input field of the field that errored out
button.click()
// If either the full_name field errors out,
// or if any of its associated fields do - show all name related fields.
// Otherwise, just show the problematic field.
let nameFields = ["first_name", "middle_name", "last_name"]
if (nameFields.includes(fieldName) && !fullNameButtonClicked){
// Click the full name button if any of its related fields error out
fullNameButton = document.querySelector("#full_name__edit-button")
if (fullNameButton) {
fullNameButton.click()
fullNameButtonClicked = true
}
let readonlyId = getReadonlyFieldId("full_name");
let readonlyField = document.querySelector(readonlyId);
if (readonlyField) {
readonlyField.classList.toggle("overlapped-full-name-field");
}
}
}
}
});
});

View file

@ -42,12 +42,12 @@
font-weight: bold;
}
}
/*
.usa-form-readonly:first-of-type {
&.usa-form-readonly--no-border {
border-top: None;
margin-top: 0px !important;
}*/
}
}
.usa-form-readonly > .usa-form-group:first-of-type {
margin-top: unset;

View file

@ -63,12 +63,12 @@
Your contact information
</legend>
{% with show_edit_button=True show_readonly=True group_classes="usa-form-readonly padding-top-2" %}
{% with show_edit_button=True show_readonly=True group_classes="usa-form-readonly usa-form-readonly--no-border padding-top-2" %}
{% input_with_errors form.full_name %}
{% endwith %}
<div id="profile-name-fieldset" class="display-none" role="group">
{% with group_classes="usa-form-readonly padding-top-2" %}
{% with group_classes="usa-form-readonly usa-form-readonly--no-border padding-top-2" %}
{% input_with_errors form.first_name %}
{% endwith %}

View file

@ -326,41 +326,6 @@ class UserDeleteDomainRolePermission(PermissionsLoginMixin):
return True
class ContactPermission(PermissionsLoginMixin):
"""Permission mixin for UserDomainRole if user
has access, otherwise 403"""
def has_permission(self):
"""Check if this user has access to this domain request.
The user is in self.request.user and the domain needs to be looked
up from the domain's primary key in self.kwargs["pk"]
"""
# Check if the user is authenticated
if not self.request.user.is_authenticated:
return False
given_contact_pk = self.kwargs["pk"]
# Grab the user in the DB to do a full object comparision, not just on ids
current_user = self.request.user
# Compare the PK that was passed in to the user currently logged in
if current_user.contact.pk != given_contact_pk:
# Don't allow users to modify other users profiles
return False
# Check if the object at the id we're searching on actually exists
requested_user_exists = User.objects.filter(pk=current_user.pk).exists()
requested_contact_exists = Contact.objects.filter(user=current_user.pk, pk=given_contact_pk).exists()
if not requested_user_exists or not requested_contact_exists:
return False
return True
class DomainRequestPermissionWithdraw(PermissionsLoginMixin):
"""Permission mixin that redirects to withdraw action on domain request
if user has access, otherwise 403"""
@ -430,7 +395,27 @@ class UserProfilePermission(PermissionsLoginMixin):
If the user is authenticated, they have access
"""
# Check if the user is authenticated
if not self.request.user.is_authenticated:
return False
# If we are given a pk in the request, do checks on it
given_contact_pk = self.kwargs["pk"]
if given_contact_pk:
# Grab the user in the DB to do a full object comparision, not just on ids
current_user = self.request.user
# Compare the PK that was passed in to the user currently logged in
if current_user.contact.pk != given_contact_pk:
# Don't allow users to modify other users profiles
return False
# Check if the object at the id we're searching on actually exists
requested_user_exists = User.objects.filter(pk=current_user.pk).exists()
requested_contact_exists = Contact.objects.filter(user=current_user.pk, pk=given_contact_pk).exists()
if not requested_user_exists or not requested_contact_exists:
return False
return True

View file

@ -13,7 +13,6 @@ from .mixins import (
DomainRequestWizardPermission,
UserDeleteDomainRolePermission,
UserProfilePermission,
ContactPermission,
)
import logging
@ -163,17 +162,3 @@ class UserProfilePermissionView(UserProfilePermission, DetailView, abc.ABC):
def template_name(self):
raise NotImplementedError
class ContactPermissionView(ContactPermission, DetailView, abc.ABC):
"""Abstract base view for domain requests that enforces permissions
This abstract view cannot be instantiated. Actual views must specify
`template_name`.
"""
# DetailView property for what model this is viewing
model = Contact
object: Contact
# variable name in template context for the model object
context_object_name = "contact"