Fix permissions

aleksis/apps/chronos/managers.py

@@ -885,6 +885,15 @@ class LessonEventQuerySet(PolymorphicQuerySet):
             Q(groups__members=person) | Q(pk__in=amended)
         ).distinct()
 
+    def for_owner(self, person: Union[int, Person]) -> "LessonEventQuerySet":
+        """Get all lesson events the person owns any group of (including amends)."""
+        amended = self.filter(
+            Q(amended_by__isnull=False) | Q(groups__owners=person)
+        ).values_list("amended_by__pk", flat=True)
+        return self.filter(
+            Q(groups__owners=person) | Q(pk__in=amended)
+        ).distinct()
+
     def for_group(self, group: Union[int, Group]) -> "LessonEventQuerySet":
         """Get all lesson events for a certain group (including amends/as parent group)."""
         amended = self.filter(

aleksis/apps/chronos/models.py

@@ -1567,6 +1567,8 @@ class LessonEvent(CalendarEvent):
                     return objs.for_room(obj_id)
                 elif type_ == "COURSE":
                     return objs.for_course(obj_id)
+                elif type_ == "OWNER":
+                    return objs.for_owner(obj_id)
 
             if "own" in params:
                 return objs
@@ -1601,6 +1603,13 @@ class LessonEvent(CalendarEvent):
                     "id": obj_id,
                 }
             )
+        else:
+            event_params.update(
+                {
+                    "type": "OWNER",
+                    "id": request.user.person.id,
+                }
+            )
 
         events = LessonEvent.get_single_events(
             date_start, date_end, request, event_params, with_reference_object=True

aleksis/apps/chronos/rules.py

@@ -12,6 +12,7 @@ from .util.predicates import (
     has_any_group_substitution_perm,
     has_any_timetable_object,
     has_group_substitution_perm,
+    has_substitution_perm_by_group,
     has_room_timetable_perm,
     has_timetable_perm,
 )
@@ -41,9 +42,18 @@ add_perm("chronos.view_substitution_overview_rule", view_substitution_overview_p
 manage_substitutions_for_group_predicate = has_person & has_group_substitution_perm
 add_perm("chronos.manage_substitutions_for_group_rule", manage_substitutions_for_group_predicate)
 
+# Add substitution
+add_substitution_predicate = has_person & (
+    has_substitution_perm_by_group
+    | has_global_perm("chronos.add_lessonsubstitution")
+    | has_object_perm("chronos.add_lessonsubstitution")
+)
+add_perm("chronos.add_substitution_rule", add_substitution_predicate)
+
 # Edit substition
 edit_substitution_predicate = has_person & (
-    has_global_perm("chronos.change_lessonsubstitution")
+    has_substitution_perm_by_group
+    | has_global_perm("chronos.change_lessonsubstitution")
     | has_object_perm("chronos.change_lessonsubstitution")
 )
 add_perm("chronos.edit_substitution_rule", edit_substitution_predicate)

aleksis/apps/chronos/schema/__init__.py

@@ -189,7 +189,7 @@ class SubstitutionBatchCreateOrUpdateMutation(graphene.Mutation):
                 amended_lesson_event.timezone
             )
 
-            if info.context.user.has_perm("chronos.change_lessonsubstitution"):
+            if info.context.user.has_perm("chronos.add_substitution_rule", amended_lesson_event):
                 obj = LessonEvent.objects.create(
                     datetime_start=datetime_start,
                     datetime_end=datetime_end,
@@ -208,7 +208,7 @@ class SubstitutionBatchCreateOrUpdateMutation(graphene.Mutation):
         else:
             obj = LessonEvent.objects.get(id=_id)
 
-            if not info.context.user.has_perm("chronos.edit_substitution_rule", obj):
+            if not info.context.user.has_perm("chronos.edit_substitution_rule", obj.amends):
                 raise PermissionDenied()
 
             if substitution.subject is not None:

aleksis/apps/chronos/util/predicates.py

@@ -4,9 +4,11 @@ from django.db.models import Model
 from rules import predicate
 
 from aleksis.core.models import Group, Person, Room
+from aleksis.core.util.core_helpers import queryset_rules_filter
 from aleksis.core.util.predicates import has_any_object, has_global_perm, has_object_perm
 
 from .chronos_helpers import get_groups, get_rooms, get_teachers
+from ..models import LessonEvent
 
 
 @predicate
@@ -44,13 +46,27 @@ def has_group_timetable_perm(user: User, obj: Group) -> bool:
     )
 
 
+@predicate
+def has_substitution_perm_by_group(user: User, obj: LessonEvent) -> bool:
+    """
+    Check if can create/edit substitution based on group.
+
+    Predicate which checks whether the user is allowed
+    to create/edit the requested substitution.
+    """
+    return (
+        obj.groups.filter(pk__in=user.person.owner_of.values_list("id", flat=True)).exists()
+        or queryset_rules_filter(user, obj.groups.all(), "core.manage_group_substitutions").exists()
+    )
+
+
 @predicate
 def has_group_substitution_perm(user: User, obj: Group) -> bool:
     """
-    Check if can access/edit group substitutions.
+    Check if can access/edit substitutions of given group.
 
     Predicate which checks whether the user is allowed
-    to access/edit the requested group substitutions.
+    to access/edit the substitutions of the given group.
     """
     return (
         obj in user.person.owner_of.all()
@@ -62,14 +78,13 @@ def has_group_substitution_perm(user: User, obj: Group) -> bool:
 @predicate
 def has_any_group_substitution_perm(user: User) -> bool:
     """
-    Check if can access/edit any group substitutions.
+    Check if can create/edit substitutions of any group.
 
     Predicate which checks whether the user is allowed
-    to access/edit any group substitutions.
+    to create/edit any substitutions of any group.
     """
     return (
         user.person.owner_of.exists()
-        or has_global_perm("chronos.view_lessonsubstitution")(user)
         or has_any_object("core.manage_group_substitutions", Group)(user)
     )