Some permissions

apps/food/forms.py

@@ -260,7 +260,13 @@ class RecipeForm(forms.ModelForm):
     """
     class Meta:
         model = Recipe
-        fields = ('name',)
+        fields = ('name', 'creater',)
+        widgets = {
+            "creater": Autocomplete(
+                model=Club,
+                attrs={"api_url": "/api/members/club/"},
+            ),
+        }
 
 
 class RecipeIngredientsForm(forms.Form):

apps/food/models.py

@@ -396,6 +396,12 @@ class Supplement(models.Model):
         return _("Supplement {food} for {dish}").format(
             food=str(self.food), dish=str(self.dish))
 
+    def save(self, *args, **kwargs):
+        # Check the owner of the food
+        if self.food.owner != self.dish.main.owner:
+            raise ValidationError(_('You cannot select food that belongs to the same club than the main food.'))
+        return super().save(*args, **kwargs)
+
 
 class Order(models.Model):
     """
@@ -471,6 +477,8 @@ class Order(models.Model):
             user=str(self.user))
 
     def save(self, *args, **kwargs):
+        if self.activity != self.dish.activity:
+            raise ValidationError(_('Activities must be the same.'))
         created = self.pk is None
         if created:
             last_order = Order.objects.filter(activity=self.activity).last()
@@ -486,6 +494,7 @@ class Order(models.Model):
                 destination=self.activity.organizer.note,
                 amount=self.amount,
                 quantity=1,
+                reason=str(self.dish),
             )
             transaction.save()
         else:

apps/food/views.py

@@ -308,7 +308,7 @@ class ManageIngredientsView(LoginRequiredMixin, UpdateView):
             prefix = 'form-' + str(i) + '-'
 
             ingredient = None
-            if form.data[prefix + 'qrcode'] not in ['0', '']:
+            if form.data[prefix + 'qrcode'] not in ['0', '', 'NaN']:
                 ingredient = QRCode.objects.get(pk=form.data[prefix + 'qrcode']).food_container
 
             elif form.data[prefix + 'name'] != '':
@@ -1064,9 +1064,12 @@ def get_ingredients_for_recipe(request):
     # Union des Foods dont le nom commence par un nom d’ingrédient
     query = Q()
     for name in ingredient_names:
-        query |= Q(name__istartswith=name)
+        valid_regex = is_regex(name)
-
+        suffix = '__iregex' if valid_regex else '__istartswith'
+        prefix = '.*' if valid_regex else ''
+        query |= Q(**{f'name{suffix}': prefix + name}, end_of_life='')
     qs = Food.objects.filter(query).distinct()
+    qs = qs.filter(PermissionBackend.filter_queryset(request, Food, 'view'))
 
     data = [{'id': f.id, 'name': f.name, 'qr_code_numbers': ", ".join(str(q.qr_code_number) for q in f.QR_code.all())} for f in qs]
     return JsonResponse({'ingredients': data})

apps/permission/fixtures/initial.json

@@ -4718,6 +4718,201 @@
             "description": "Voir l'adresse mail des membres de son club"
         }
     },
+    {
+	"model": "permission.permission",
+	"pk": 331,
+	"fields": {
+	    "model": [
+		"food",
+		"dish"
+	    ],
+	    "query": "{\"activity__organizer\": [\"club\"]}",
+	    "type": "create",
+	    "mask": 2,
+	    "permanent": false,
+	    "description": "Créer un plat vendu par son club"
+	}
+    },
+    {
+	"model": "permission.permission",
+	"pk": 332,
+	"fields": {
+	    "model": [
+		"food",
+		"dish"
+	    ],
+	    "query": "{\"activity__organizer\": [\"club\"]}",
+	    "type": "change",
+	    "mask": 2,
+	    "permanent": false,
+	    "description": "Modifier un plat vendu par son club"
+	}
+    },
+    {
+	"model": "permission.permission",
+	"pk": 333,
+	"fields": {
+	    "model": [
+		"food",
+		"dish"
+	    ],
+	    "query": "{\"activity__organizer\": [\"club\"]}",
+	    "type": "view",
+	    "mask": 2,
+	    "permanent": false,
+	    "description": "Voir les plats vendus par son club"
+	}
+    },
+    {
+	"model": "permission.permission",
+	"pk": 334,
+	"fields": {
+	    "model": [
+		"food",
+		"dish"
+	    ],
+	    "query": "[\"AND\", {\"activity__open\": true}, {\"available\": true}]",
+	    "type": "view",
+	    "mask": 1,
+	    "permanent": false,
+	    "description": "Voir les plats disponibles"
+	}
+    },
+    {
+	"model": "permission.permission",
+	"pk": 335,
+	"fields": {
+	    "model": [
+		"food",
+		"supplement"
+	    ],
+	    "query": "{\"dish__main__owner\": [\"club\"]}",
+	    "type": "create",
+	    "mask": 2,
+	    "permanent": false,
+	    "description": "Ajouter un supplément à un plat de son club"
+	}
+    },
+    {
+	"model": "permission.permission",
+	"pk": 336,
+	"fields": {
+	    "model": [
+		"food",
+		"supplement"
+	    ],
+	    "query": "{\"dish__main__owner\": [\"club\"]}",
+	    "type": "change",
+	    "mask": 2,
+	    "permanent": false,
+	    "description": "Modifier un supplément d'un plat de son club"
+	}
+    },
+    {
+	"model": "permission.permission",
+	"pk": 337,
+	"fields": {
+	    "model": [
+		"food",
+		"supplement"
+	    ],
+	    "query": "{\"dish__main__owner\": [\"club\"]}",
+	    "type": "view",
+	    "mask": 2,
+	    "permanent": false,
+	    "description": "Voir les suppléments des plats de son club"
+	}
+    },
+    {
+	"model": "permission.permission",
+	"pk": 337,
+	"fields": {
+	    "model": [
+		"food",
+		"supplement"
+	    ],
+	    "query": "[\"AND\", {\"dish__activity__open\": true}, {\"dish__available\": true}]",
+	    "type": "view",
+	    "mask": 1,
+	    "permanent": false,
+	    "description": "Voir les suppléments des plats disponibles"
+	}
+    },
+    {
+	"model": "permission.permission",
+	"pk": 338,
+	"fields": {
+	    "model": [
+		"food",
+		"supplement"
+	    ],
+	    "query": "{\"dish__main__owner\": [\"club\"]}",
+	    "type": "delete",
+	    "mask": 2,
+	    "permanent": false,
+	    "description": "Supprimer un supplément d'un plat de son club"
+	}
+    },
+    {
+	"model": "permission.permission",
+	"pk": 339,
+	"fields": {
+	    "model": [
+		"food",
+		"order"
+	    ],
+	    "query": "[\"AND\", {\"dish__activity__open\": true, \"dish__available\": true}, {\"user\": [\"user\"]}]",
+	    "type": "create",
+	    "mask": 1,
+	    "permanent": false,
+	    "description": "Commander un plat"
+	}
+    },
+    {
+	"model": "permission.permission",
+	"pk": 340,
+	"fields": {
+	    "model": [
+		"food",
+		"order"
+	    ],
+	    "query": "[\"AND\", {\"dish__activity__open\": true}, {\"user\": [\"user\"]}]",
+	    "type": "view",
+	    "mask": 1,
+	    "permanent": false,
+	    "description": "Voir ses commandes pour les activités ouvertes"
+	}
+    },
+    {
+	"model": "permission.permission",
+	"pk": 341,
+	"fields": {
+	    "model": [
+		"food",
+		"order"
+	    ],
+	    "query": "{\"activity__open\": true, \"activity__organizer\": [\"club\"]}",
+	    "type": "view",
+	    "mask": 2,
+	    "permanent": false,
+	    "description": "Voir toutes les commandes pour les activités ouvertes de son club"
+	}
+    },
+    {
+	"model": "permission.permission",
+	"pk": 342,
+	"fields": {
+	    "model": [
+		"food",
+		"order"
+	    ],
+	    "query": "{\"activity__open\": true, \"activity__organizer\": [\"club\"]}",
+	    "type": "change",
+	    "mask": 2,
+	    "permanent": false,
+	    "description": "Modifier un commande non servie d'une activité de son club"
+	}
+    },
     {
         "model": "permission.role",
         "pk": 1,