Some permissions

apps/food/forms.py

@@ -260,7 +260,13 @@ class RecipeForm(forms.ModelForm):
     """
     class Meta:
         model = Recipe
-        fields = ('name',)
+        fields = ('name', 'creater',)
+        widgets = {
+            "creater": Autocomplete(
+                model=Club,
+                attrs={"api_url": "/api/members/club/"},
+            ),
+        }
 
 
 class RecipeIngredientsForm(forms.Form):

apps/food/models.py

@@ -396,6 +396,12 @@ class Supplement(models.Model):
         return _("Supplement {food} for {dish}").format(
             food=str(self.food), dish=str(self.dish))
 
+    def save(self, *args, **kwargs):
+        # Check the owner of the food
+        if self.food.owner != self.dish.main.owner:
+            raise ValidationError(_('You cannot select food that belongs to the same club than the main food.'))
+        return super().save(*args, **kwargs)
+
 
 class Order(models.Model):
     """
@@ -471,6 +477,8 @@ class Order(models.Model):
             user=str(self.user))
 
     def save(self, *args, **kwargs):
+        if self.activity != self.dish.activity:
+            raise ValidationError(_('Activities must be the same.'))
         created = self.pk is None
         if created:
             last_order = Order.objects.filter(activity=self.activity).last()
@@ -486,6 +494,7 @@ class Order(models.Model):
                 destination=self.activity.organizer.note,
                 amount=self.amount,
                 quantity=1,
+                reason=str(self.dish),
             )
             transaction.save()
         else:

apps/food/views.py

@@ -308,7 +308,7 @@ class ManageIngredientsView(LoginRequiredMixin, UpdateView):
             prefix = 'form-' + str(i) + '-'
 
             ingredient = None
-            if form.data[prefix + 'qrcode'] not in ['0', '']:
+            if form.data[prefix + 'qrcode'] not in ['0', '', 'NaN']:
                 ingredient = QRCode.objects.get(pk=form.data[prefix + 'qrcode']).food_container
 
             elif form.data[prefix + 'name'] != '':
@@ -1064,9 +1064,12 @@ def get_ingredients_for_recipe(request):
     # Union des Foods dont le nom commence par un nom d’ingrédient
     query = Q()
     for name in ingredient_names:
-        query |= Q(name__istartswith=name)
-
+        valid_regex = is_regex(name)
+        suffix = '__iregex' if valid_regex else '__istartswith'
+        prefix = '.*' if valid_regex else ''
+        query |= Q(**{f'name{suffix}': prefix + name}, end_of_life='')
     qs = Food.objects.filter(query).distinct()
+    qs = qs.filter(PermissionBackend.filter_queryset(request, Food, 'view'))
 
     data = [{'id': f.id, 'name': f.name, 'qr_code_numbers': ", ".join(str(q.qr_code_number) for q in f.QR_code.all())} for f in qs]
     return JsonResponse({'ingredients': data})