Merge pull request #664 from maykinmedia/fix/663-issue-reviewers

[#663] Record manager can assign co-reviewers to new list

backend/src/openarchiefbeheer/destruction/api/permissions.py

@@ -125,7 +125,16 @@ def has_permission(self, request, view):
         ) or request.user.has_perm("accounts.can_start_destruction")
 
     def has_object_permission(self, request, view, destruction_list):
-        return destruction_list.status == ListStatus.ready_to_review
+        if request.user.has_perm("accounts.can_review_destruction"):
+            return destruction_list.status == ListStatus.ready_to_review
+
+        if request.user.has_perm("accounts.can_start_destruction"):
+            return destruction_list.status in [
+                ListStatus.ready_to_review,
+                ListStatus.new,
+            ]
+
+        return False
 
 
 class CanDownloadReport(permissions.BasePermission):

backend/src/openarchiefbeheer/destruction/api/serializers.py

@@ -96,7 +96,7 @@ def validate(self, attrs: dict) -> dict:
 
         destruction_list = self.context["destruction_list"]
         main_reviewer = destruction_list.assignees.get(role=ListRole.main_reviewer)
-        if main_reviewer.pk == attrs["user"].pk:
+        if main_reviewer.user.pk == attrs["user"].pk:
             raise ValidationError(
                 {"user": _("The main reviewer cannot also be a co-reviewer.")}
             )

backend/src/openarchiefbeheer/destruction/tests/endpoints/test_co_reviewers.py

@@ -426,3 +426,47 @@ def test_record_manager_assigns_themselves(self):
             response.json()["add"][0]["user"][0],
             _("The author of a list cannot be assigned as a co-reviewer."),
         )
+
+    @tag("gh-663")
+    def test_record_manager_assigns_themselves_to_new_list(self):
+        author = UserFactory.create(
+            username="record_manager",
+            post__can_start_destruction=True,
+        )
+        administrator = UserFactory.create(
+            username="administrator",
+            post__can_start_destruction=True,
+            post__can_co_review_destruction=True,
+        )
+        destruction_list = DestructionListFactory.create(
+            status=ListStatus.new, name="Test assignement to new list", author=author
+        )
+        DestructionListAssigneeFactory.create(
+            role=ListRole.author,
+            user=author,
+            destruction_list=destruction_list,
+        )
+        DestructionListAssigneeFactory.create(
+            role=ListRole.main_reviewer,
+            destruction_list=destruction_list,
+        )
+
+        self.client.force_authenticate(user=administrator)
+        response = self.client.put(
+            reverse(
+                "api:co-reviewers-list",
+                kwargs={"destruction_list_uuid": destruction_list.uuid},
+            ),
+            data={
+                "comment": "test",
+                "add": [{"user": administrator.pk}],
+            },
+            format="json",
+        )
+
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+
+        coreviewers = destruction_list.assignees.filter(role=ListRole.co_reviewer)
+
+        self.assertEqual(1, len(coreviewers))
+        self.assertEqual(coreviewers[0].user.pk, administrator.pk)