From 61261c981641279fe132cb666203cae77500e03b Mon Sep 17 00:00:00 2001
From: philipp <philipp@hofer.link>
Date: Tue, 23 Apr 2024 22:23:24 +0200
Subject: [PATCH 1/2] allow edits of boatreservations, Fixes #417

---
 src/model/boatreservation.rs         | 15 +++++++
 src/tera/boatreservation.rs          | 58 ++++++++++++++++++++++++++--
 src/tera/mod.rs                      |  2 +-
 templates/boatreservations.html.tera | 34 +++++++++++-----
 4 files changed, 96 insertions(+), 13 deletions(-)

diff --git a/src/model/boatreservation.rs b/src/model/boatreservation.rs
index 311f966..bacddea 100644
--- a/src/model/boatreservation.rs
+++ b/src/model/boatreservation.rs
@@ -1,4 +1,5 @@
 use crate::model::{boat::Boat, user::User};
+use crate::tera::boatreservation::ReservationEditForm;
 use chrono::NaiveDate;
 use chrono::NaiveDateTime;
 use rocket::serde::{Deserialize, Serialize};
@@ -177,6 +178,20 @@ AND start_date <= ? AND end_date >= ?;",
             > 0
     }
 
+    pub async fn update(&self, db: &SqlitePool, data: ReservationEditForm) {
+        let time_desc = data.time_desc.trim();
+        let usage = data.usage.trim();
+        sqlx::query!(
+            "UPDATE boat_reservation SET time_desc = ?, usage = ? where id = ?",
+            time_desc,
+            usage,
+            self.id
+        )
+        .execute(db)
+        .await
+        .unwrap(); //Okay, because we can only create a User of a valid id
+    }
+
     pub async fn delete(&self, db: &SqlitePool) {
         sqlx::query!("DELETE FROM boat_reservation WHERE id=?", self.id)
             .execute(db)
diff --git a/src/tera/boatreservation.rs b/src/tera/boatreservation.rs
index 0cc5574..5205fff 100644
--- a/src/tera/boatreservation.rs
+++ b/src/tera/boatreservation.rs
@@ -14,6 +14,7 @@ use crate::{
     model::{
         boat::Boat,
         boatreservation::{BoatReservation, BoatReservationToAdd},
+        log::Log,
         user::{DonauLinzUser, User, UserWithRoles},
     },
     tera::log::KioskCookie,
@@ -90,7 +91,7 @@ pub struct FormBoatReservationToAdd<'r> {
     pub user_id_applicant: Option<i64>,
 }
 
-#[post("/", data = "<data>", rank = 2)]
+#[post("/new", data = "<data>", rank = 2)]
 async fn create<'r>(
     db: &State<SqlitePool>,
     data: Form<FormBoatReservationToAdd<'r>>,
@@ -115,7 +116,7 @@ async fn create<'r>(
     }
 }
 
-#[post("/", data = "<data>")]
+#[post("/new", data = "<data>")]
 async fn create_from_kiosk<'r>(
     db: &State<SqlitePool>,
     data: Form<FormBoatReservationToAdd<'r>>,
@@ -142,6 +143,50 @@ async fn create_from_kiosk<'r>(
     }
 }
 
+#[derive(FromForm, Debug)]
+pub struct ReservationEditForm {
+    pub(crate) id: i32,
+    pub(crate) time_desc: String,
+    pub(crate) usage: String,
+}
+
+#[post("/", data = "<data>")]
+async fn update(
+    db: &State<SqlitePool>,
+    data: Form<ReservationEditForm>,
+    user: User,
+) -> Flash<Redirect> {
+    let Some(reservation) = BoatReservation::find_by_id(db, data.id).await else {
+        return Flash::error(
+            Redirect::to("/boatreservation"),
+            format!("Reservation with ID {} does not exist!", data.id),
+        );
+    };
+
+    if user.id != reservation.user_id_applicant && !user.has_role(db, "admin").await {
+        return Flash::error(
+            Redirect::to("/boatreservation"),
+            format!("Not allowed to update reservation (only admins + creator do so)."),
+        );
+    }
+
+    Log::create(
+        db,
+        format!(
+            "{} updated reservation from {reservation:?} to {data:?}",
+            user.name
+        ),
+    )
+    .await;
+
+    reservation.update(db, data.into_inner()).await;
+
+    Flash::success(
+        Redirect::to("/boatreservation"),
+        "Reservierung erfolgreich bearbeitet",
+    )
+}
+
 #[get("/<reservation_id>/delete")]
 async fn delete<'r>(
     db: &State<SqlitePool>,
@@ -167,5 +212,12 @@ async fn delete<'r>(
 }
 
 pub fn routes() -> Vec<Route> {
-    routes![index, index_kiosk, create, create_from_kiosk, delete]
+    routes![
+        index,
+        index_kiosk,
+        create,
+        create_from_kiosk,
+        delete,
+        update
+    ]
 }
diff --git a/src/tera/mod.rs b/src/tera/mod.rs
index 5f89c2b..0ee0bf8 100644
--- a/src/tera/mod.rs
+++ b/src/tera/mod.rs
@@ -30,7 +30,7 @@ pub(crate) mod admin;
 mod auth;
 pub(crate) mod board;
 mod boatdamage;
-mod boatreservation;
+pub(crate) mod boatreservation;
 mod cox;
 mod ergo;
 mod log;
diff --git a/templates/boatreservations.html.tera b/templates/boatreservations.html.tera
index 6ddb6cd..0cdb8f3 100644
--- a/templates/boatreservations.html.tera
+++ b/templates/boatreservations.html.tera
@@ -18,7 +18,7 @@
         </h2>
         <div class="hidden">
             <div id="new-reservation">
-                <form action="/boatreservation" method="post" class="grid gap-3">
+                <form action="/boatreservation/new" method="post" class="grid gap-3">
                     {{ log::boat_select(only_ones=false, id='boat') }}
                     {% if not loggedin_user %}{{ macros::select(label='Reserviert von', data=user, name='user_id_applicant') }}{% endif %}
                     {{ macros::input(label='Beginn', name='start_date', type='date', required=true, wrapper_class='col-span-4') }}
@@ -41,6 +41,12 @@
         </div>
         <div id="filter-result-js" class="search-result"></div>
         {% for reservation in boatreservations %}
+            {% set allowed_to_edit = false %}
+            {% if loggedin_user %}
+                {% if loggedin_user.id == reservation.user_applicant.id or "admin" in loggedin_user.roles %}
+                    {% set allowed_to_edit = true %}
+                {% endif %}
+            {% endif %}
             <div data-filterable="true"
                  data-filter="{{ reservation.user_applicant.name }} {{ reservation.boat.name }}"
                  class="w-full border-t bg-white dark:bg-primary-900 text-black dark:text-white p-3">
@@ -58,13 +64,22 @@
                         {{ reservation.end_date }}
                     {% endif %}
                     <br />
-                    <strong>Uhrzeit:</strong>
-                    {{ reservation.time_desc }}
-                    <br />
-                    <strong>Zweck:</strong>
-                    {{ reservation.usage }}
-                    {% if loggedin_user %}
-                        {% if loggedin_user.id == reservation.user_applicant.id or "admin" in loggedin_user.roles %}
+                    {% if not allowed_to_edit %}
+                        <strong>Uhrzeit:</strong>
+                        {{ reservation.time_desc }}
+                        <br />
+                        <strong>Zweck:</strong>
+                        {{ reservation.usage }}
+                    {% endif %}
+                    {% if allowed_to_edit %}
+                        <form action="/boatreservation"
+                              method="post"
+                              class="bg-white dark:bg-primary-900 p-3 rounded-md w-full">
+                            <div class="w-full grid gap-3">
+                                <input type="hidden" name="id" value="{{ reservation.id }}" />
+                                {{ macros::input(label='Uhrzeit', name='time_desc', id=loop.index, type="text", value=reservation.time_desc, readonly=false) }}
+                                {{ macros::input(label='Zweck', name='usage', id=loop.index, type="text", value=reservation.usage, readonly=false) }}
+                            </div>
                             <div class="mt-3 text-right">
                                 <a href="/boatreservation/{{ reservation.id }}/delete"
                                    class="w-28 btn btn-alert"
@@ -72,8 +87,9 @@
                                     {% include "includes/delete-icon" %}
                                     Löschen
                                 </a>
+                                <input value="Ändern" type="submit" class="w-28 btn btn-primary ml-1" />
                             </div>
-                        {% endif %}
+                        </form>
                     {% endif %}
                 </div>
             </div>
-- 
2.45.2


From d9885f9bba5f9377ba1df6ddce4c34b536b8df2b Mon Sep 17 00:00:00 2001
From: Marie Birner <mb@studiomitte.com>
Date: Tue, 23 Apr 2024 22:58:48 +0200
Subject: [PATCH 2/2] [TASK] change padding form

---
 templates/boatreservations.html.tera | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/templates/boatreservations.html.tera b/templates/boatreservations.html.tera
index 0cdb8f3..ffd0b7d 100644
--- a/templates/boatreservations.html.tera
+++ b/templates/boatreservations.html.tera
@@ -74,7 +74,7 @@
                     {% if allowed_to_edit %}
                         <form action="/boatreservation"
                               method="post"
-                              class="bg-white dark:bg-primary-900 p-3 rounded-md w-full">
+                              class="bg-white dark:bg-primary-900 pt-3 rounded-md w-full">
                             <div class="w-full grid gap-3">
                                 <input type="hidden" name="id" value="{{ reservation.id }}" />
                                 {{ macros::input(label='Uhrzeit', name='time_desc', id=loop.index, type="text", value=reservation.time_desc, readonly=false) }}
-- 
2.45.2