From 9c3ae7434e771bb6a02a9b730ba082e91bebdb6a Mon Sep 17 00:00:00 2001
From: philipp <philipp@hofer.link>
Date: Mon, 4 Mar 2024 09:19:04 +0100
Subject: [PATCH] allow vorstand to see member details, Fixes #199

---
 src/tera/admin/user.rs               | 11 ++++++-----
 templates/admin/user/index.html.tera | 28 +++++++++++++++++-----------
 templates/includes/macros.html.tera  |  4 ++--
 templates/index.html.tera            |  1 +
 4 files changed, 26 insertions(+), 18 deletions(-)

diff --git a/src/tera/admin/user.rs b/src/tera/admin/user.rs
index 91e8ee8..be3f7a8 100644
--- a/src/tera/admin/user.rs
+++ b/src/tera/admin/user.rs
@@ -19,7 +19,7 @@ use sqlx::SqlitePool;
 #[get("/user")]
 async fn index(
     db: &State<SqlitePool>,
-    admin: AdminUser,
+    user: VorstandUser,
     flash: Option<FlashMessage<'_>>,
 ) -> Template {
     let user_futures: Vec<_> = User::all(db)
@@ -28,6 +28,9 @@ async fn index(
         .map(|u| async move { UserWithRoles::from_user(u, db).await })
         .collect();
 
+    let user: User = user.into();
+    let allowed_to_edit = user.has_role(db, "admin").await;
+
     let users: Vec<UserWithRoles> = join_all(user_futures).await;
 
     let roles = Role::all(db).await;
@@ -37,13 +40,11 @@ async fn index(
     if let Some(msg) = flash {
         context.insert("flash", &msg.into_inner());
     }
+    context.insert("allowed_to_edit", &allowed_to_edit);
     context.insert("users", &users);
     context.insert("roles", &roles);
     context.insert("families", &families);
-    context.insert(
-        "loggedin_user",
-        &UserWithRoles::from_user(admin.user, db).await,
-    );
+    context.insert("loggedin_user", &UserWithRoles::from_user(user, db).await);
 
     Template::render("admin/user/index", context.into_json())
 }
diff --git a/templates/admin/user/index.html.tera b/templates/admin/user/index.html.tera
index 496e5c9..619f838 100644
--- a/templates/admin/user/index.html.tera
+++ b/templates/admin/user/index.html.tera
@@ -10,6 +10,7 @@
 
 		<h1 class="h1">Users</h1>
 
+		{% if allowed_to_edit %}
 		<form action="/admin/user/new" method="post" class="mt-4 bg-primary-900 rounded-md text-white px-3 pb-3 pt-2 sm:flex items-end justify-between">
 			<div class="w-full">
 				<h2 class="text-md font-bold mb-2 uppercase tracking-wide">Neuen User hinzufügen</h2>
@@ -24,6 +25,7 @@
 				<input value="Hinzufügen" type="submit" class="w-28 mt-2 sm:mt-0 rounded-md bg-primary-500 px-3 py-2 text-sm font-semibold text-white hover:bg-primary-500 focus-visible:outline focus-visible:outline-2 focus-visible:outline-offset-2 focus-visible:outline-primary-600 cursor-pointer"/>
 			</div>
 		</form>
+		{% endif %}
 
 		<!-- START filterBar -->
 		<div class="search-wrapper">
@@ -60,21 +62,24 @@
               </div>
               <div class="grid sm:grid-cols-2 lg:grid-cols-4 gap-3">
 	      	{% for role in roles %}
-                	{{ macros::checkbox(label=role.name, name="roles[" ~ role.id ~ "]", id=loop.index , checked=role.name in user.roles) }}
+                	{{ macros::checkbox(label=role.name, name="roles[" ~ role.id ~ "]", id=loop.index , checked=role.name in user.roles, disabled=allowed_to_edit == false) }}
 		{% endfor%}
-                {{ macros::input(label='DOB', name='dob', id=loop.index, type="text", value=user.dob) }}
-                {{ macros::input(label='Weight (kg)', name='weight', id=loop.index, type="text", value=user.weight) }}
-                {{ macros::input(label='Sex', name='sex', id=loop.index, type="text", value=user.sex) }}
-                {{ macros::input(label='Mitglied seit', name='member_since_date', id=loop.index, type="text", value=user.member_since_date) }}
-                {{ macros::input(label='Geburtsdatum', name='birthdate', id=loop.index, type="text", value=user.birthdate) }}
-                {{ macros::input(label='Mail', name='mail', id=loop.index, type="text", value=user.mail) }}
-                {{ macros::input(label='Nickname', name='nickname', id=loop.index, type="text", value=user.nickname) }}
-                {{ macros::input(label='Notizen', name='notes', id=loop.index, type="text", value=user.notes) }}
-                {{ macros::input(label='Telefon', name='phone', id=loop.index, type="text", value=user.phone) }}
-                {{ macros::input(label='Adresse', name='address', id=loop.index, type="text", value=user.address) }}
+                {{ macros::input(label='DOB', name='dob', id=loop.index, type="text", value=user.dob, readonly=allowed_to_edit == false) }}
+                {{ macros::input(label='Weight (kg)', name='weight', id=loop.index, type="text", value=user.weight, readonly=allowed_to_edit == false) }}
+                {{ macros::input(label='Sex', name='sex', id=loop.index, type="text", value=user.sex, readonly=allowed_to_edit == false) }}
+                {{ macros::input(label='Mitglied seit', name='member_since_date', id=loop.index, type="text", value=user.member_since_date, readonly=allowed_to_edit == false) }}
+                {{ macros::input(label='Geburtsdatum', name='birthdate', id=loop.index, type="text", value=user.birthdate, readonly=allowed_to_edit == false) }}
+                {{ macros::input(label='Mail', name='mail', id=loop.index, type="text", value=user.mail, readonly=allowed_to_edit == false) }}
+                {{ macros::input(label='Nickname', name='nickname', id=loop.index, type="text", value=user.nickname, readonly=allowed_to_edit == false) }}
+                {{ macros::input(label='Notizen', name='notes', id=loop.index, type="text", value=user.notes, readonly=allowed_to_edit == false) }}
+                {{ macros::input(label='Telefon', name='phone', id=loop.index, type="text", value=user.phone, readonly=allowed_to_edit == false) }}
+                {{ macros::input(label='Adresse', name='address', id=loop.index, type="text", value=user.address, readonly=allowed_to_edit == false) }}
+		{% if allowed_to_edit %}
           	{{ macros::select(label="Familie", data=families, name='family_id', selected_id=user.family_id, display=['names'], default="Keine Familie", new_last_entry='Neue Familie anlegen') }}
+		{% endif %}
               </div>
             </div>
+	    {% if allowed_to_edit %}
             <div class="mt-3 text-right">
               <a href="/admin/user/{{ user.id }}/delete" class="w-28 btn btn-alert" onclick="return confirm('Wirklich löschen?');">
                 {% include "includes/delete-icon" %}
@@ -82,6 +87,7 @@
               </a>
               <input value="Ändern" type="submit" class="w-28 btn btn-primary ml-1"/>
             </div>
+	    {% endif %}
           </form>
         </div>
 			{% endfor %}
diff --git a/templates/includes/macros.html.tera b/templates/includes/macros.html.tera
index a534578..fefc2e7 100644
--- a/templates/includes/macros.html.tera
+++ b/templates/includes/macros.html.tera
@@ -154,10 +154,10 @@
   <div class="h-8"></div>
 {% endmacro header %}
 
-{% macro input(label, name, type, required=false, class='rounded-md', value='', min='', hide_label=false, id='', autofocus=false, wrapper_class='', pattern='') %}
+{% macro input(label, name, type, required=false, class='rounded-md', value='', min='', hide_label=false, id='', autofocus=false, wrapper_class='', pattern='', readonly=false) %}
 	<div class="{{wrapper_class}}">
 		<label for="{{ name }}" class="{% if hide_label %} sr-only {% else %} text-sm text-gray-600 dark:text-white {% endif %}">{{ label }}</label>
-		<input {% if type=='datetime-local' %} onclick='if (!this.value) setCurrentdate(this)' {% endif %}{% if id %} id="{{ id }}" {% else %} id="{{ name }}" {% endif %} name="{{ name }}" type="{{ type }}" {% if required %} required {% endif %} value="{{ value }}" class="input {{ class }}" placeholder="{% if hide_label %}{{ label }}{% endif %}" {% if min is defined %} min="{{ min }}" {% endif %} {% if autofocus %} autofocus {% endif %}{% if pattern %}pattern="{{ pattern }}"{% endif %}>
+		<input {% if type=='datetime-local' %} onclick='if (!this.value) setCurrentdate(this)' {% endif %}{% if id %} id="{{ id }}" {% else %} id="{{ name }}" {% endif %} name="{{ name }}" type="{{ type }}" {% if required %} required {% endif %} value="{{ value }}" class="input {{ class }}" placeholder="{% if hide_label %}{{ label }}{% endif %}" {% if min is defined %} min="{{ min }}" {% endif %} {% if autofocus %} autofocus {% endif %}{% if pattern %}pattern="{{ pattern }}"{% endif %}{% if readonly %}readonly{% endif %}>
 	</div>
 {% endmacro input %}
 
diff --git a/templates/index.html.tera b/templates/index.html.tera
index 6304144..eb40ead 100644
--- a/templates/index.html.tera
+++ b/templates/index.html.tera
@@ -73,6 +73,7 @@
              <div class="text-sm p-3">
               <ul class="list-disc ms-2">
                 <li class="py-1"><a href="/admin/user/fees" class="link-primary">Übersicht User Gebühren</a></li>
+                <li class="py-1"><a href="/admin/user" class="link-primary">User</a></li>
               </ul>
             </div>
           </div>