udata 10.0.5.dev32897__py2.py3-none-any.whl → 10.0.5.dev32923__py2.py3-none-any.whl

udata/core/organization/api_fields.py

@@ -1,6 +1,7 @@
 from flask import request
 
 from udata.api import api, base_reference, fields
+from udata.auth.helpers import current_user_is_admin_or_self
 from udata.core.badges.fields import badge_fields
 from udata.core.organization.permissions import OrganizationPrivatePermission
 
@@ -60,12 +61,23 @@ def check_can_access_user_private_info():
     return OrganizationPrivatePermission(org).can()
 
 
+def member_email_with_visibility_check(email):
+    if current_user_is_admin_or_self():
+        return email
+    if check_can_access_user_private_info():
+        # Obfuscate email partially for other members
+        name, domain = email.split("@")
+        name = name[:2] + "*" * (len(name) - 2)
+        return f"{name}@{domain}"
+    return None
+
+
 member_user_with_email_fields = api.inherit(
     "MemberUserWithEmail",
     user_ref_fields,
     {
         "email": fields.Raw(
-            attribute=lambda o: o.email if check_can_access_user_private_info() else None,
+            attribute=lambda o: member_email_with_visibility_check(o.email),
             description="The user email (only present on show organization endpoint if the current user is member of the organization: admin or editor)",
             readonly=True,
         ),

udata/features/transfer/actions.py

@@ -17,6 +17,7 @@ def request_transfer(subject, recipient, comment):
     if recipient == (subject.organization or subject.owner):
         raise ValueError("Recipient should be different than the current owner")
     transfer = Transfer.objects.create(
+        user=current_user._get_current_object(),
         owner=subject.organization or subject.owner,
         recipient=recipient,
         subject=subject,

udata/features/transfer/api.py

@@ -4,6 +4,10 @@ from udata.api import API, api, base_reference, fields
 from udata.core.dataset.api_fields import dataset_ref_fields
 from udata.core.organization.api_fields import org_ref_fields
 from udata.core.user.api_fields import user_ref_fields
+from udata.features.transfer.permissions import (
+    TransferPermission,
+    TransferResponsePermission,
+)
 from udata.models import Dataset, Organization, Reuse, User, db
 from udata.utils import id_or_404
 
@@ -53,6 +57,12 @@ transfer_fields = api.model(
     "Transfer",
     {
         "id": fields.String(readonly=True, description="The transfer unique identifier"),
+        "user": fields.Nested(
+            user_ref_fields,
+            description="The user who requested the transfer",
+            readonly=True,
+            allow_null=True,
+        ),
         "owner": fields.Polymorph(
             person_mapping,
             readonly=True,
@@ -81,14 +91,51 @@ transfer_fields = api.model(
 
 ns = api.namespace("transfer")
 
+requests_parser = api.parser()
+requests_parser.add_argument(
+    "subject", type=str, help="ID of dataset, dataservice, reuse…", location="args"
+)
+requests_parser.add_argument(
+    "subject_type", choices=["Dataset", "Reuse", "Dataservice"], type=str, help="", location="args"
+)
+requests_parser.add_argument(
+    "recipient", type=str, help="ID of user or organization", location="args"
+)
+requests_parser.add_argument(
+    "status",
+    type=str,
+    choices=TRANSFER_STATUS.keys(),
+    help="ID of user or organization",
+    location="args",
+)
+
 
 @ns.route("/", endpoint="transfers")
 class TransferRequestsAPI(API):
     @api.doc("list_transfers")
     @api.marshal_list_with(transfer_fields)
     def get(self):
-        """List all transfer requests"""
-        pass
+        args = requests_parser.parse_args()
+
+        transfers = Transfer.objects
+        if args["subject"]:
+            transfers = transfers.generic_in(subject=args["subject"])
+        if args["subject_type"]:
+            transfers = transfers.filter(__raw__={"subject._cls": args["subject_type"]})
+        if args["recipient"]:
+            transfers = transfers.generic_in(recipient=args["recipient"])
+        if args["status"]:
+            transfers = transfers.filter(status=args["status"])
+
+        if not (args["subject"] or args["recipient"]):
+            api.abort(400, "Please provide at least a `subject` or a `recipient`")
+
+        return [
+            transfer
+            for transfer in transfers
+            if TransferPermission(transfer.subject).can()
+            or TransferResponsePermission(transfer).can()
+        ]
 
     @api.doc("request_transfer")
     @api.expect(transfer_request_fields)

udata/features/transfer/models.py

@@ -17,6 +17,7 @@ TRANSFER_STATUS = {
 
 
 class Transfer(db.Document):
+    user = db.ReferenceField("User")
     owner = db.GenericReferenceField(required=True)
     recipient = db.GenericReferenceField(required=True)
     subject = db.GenericReferenceField(required=True)