From ec629d14217deaf8713849271abc619ef5acb8cf Mon Sep 17 00:00:00 2001
From: Innocent Zenda <zendainnocent@gmail.com>
Date: Sun, 5 Nov 2023 10:02:27 +0300
Subject: [PATCH] restrict contact views

closes #25
---
 config/settings.py                            |  3 ++
 .../templates/contacts/contact_form.html      | 11 +++++-
 .../templates/contacts/contact_list.html      |  6 ++--
 pim/contacts/views.py                         | 34 +++++++++++++------
 static/images/star-2763.svg                   |  8 -----
 static/images/star-7207.svg                   |  8 -----
 templates/account/email_confirm.html          | 16 ++++++---
 7 files changed, 51 insertions(+), 35 deletions(-)
 delete mode 100644 static/images/star-2763.svg
 delete mode 100644 static/images/star-7207.svg

diff --git a/config/settings.py b/config/settings.py
index 119e8b1..cc26997 100644
--- a/config/settings.py
+++ b/config/settings.py
@@ -13,6 +13,7 @@
 
 from decouple import config
 from django.contrib import messages
+from django.urls import reverse_lazy
 from django.utils.translation import gettext_lazy as _
 
 # Build paths inside the project like this: BASE_DIR / 'subdir'.
@@ -215,3 +216,5 @@
 PHONENUMBER_DEFAULT_REGION = 'TZ'
 
 PHONENUMBER_DEFAULT_FORMAT = 'INTERNATIONAL'
+
+LOGIN_REDIRECT_URL = reverse_lazy('main:home')
diff --git a/pim/contacts/templates/contacts/contact_form.html b/pim/contacts/templates/contacts/contact_form.html
index b67d136..d4bcd44 100644
--- a/pim/contacts/templates/contacts/contact_form.html
+++ b/pim/contacts/templates/contacts/contact_form.html
@@ -15,7 +15,16 @@ <h2>
     {% endif %}
     {% csrf_token %}
     {{ form | crispy }}
-    <button class="btn btn-primary">
+    <button class="btn btn-primary" type="submit">
       {% trans 'Save' %}
     </button>
+    {% if object %}
+    <button class="btn btn-secondary">
+      {% trans 'Cancel' %}
+    </button>
+    {% else %}
+    <a href="{% url 'contacts:index' %}" class="btn btn-secondary">
+      {% trans 'Cancel' %}
+    </a>
+    {% endif %}
   </form>
diff --git a/pim/contacts/templates/contacts/contact_list.html b/pim/contacts/templates/contacts/contact_list.html
index 466770c..88c77b2 100644
--- a/pim/contacts/templates/contacts/contact_list.html
+++ b/pim/contacts/templates/contacts/contact_list.html
@@ -2,9 +2,9 @@
 
 <ul class="list-group" id="contacts">
   {% for contact in contacts %}
-  <li class="list-group-item btn text-start" hx-get="{% url 'contacts:contact-detail' contact.slug %}"
-    hx-trigger="click" hx-target="#detail">
-    {{ contact }}
+  <li class="list-group-item btn text-start d-flex align-items-center justify-content-between"
+    hx-get="{% url 'contacts:contact-detail' contact.slug %}" hx-trigger="click" hx-target="#detail">
+    {{ contact }} {% include 'contacts/favorite.html' with contact=contact %}
   </li>
   {% empty %}
 
diff --git a/pim/contacts/views.py b/pim/contacts/views.py
index f4a2b0f..55cccb7 100644
--- a/pim/contacts/views.py
+++ b/pim/contacts/views.py
@@ -1,4 +1,5 @@
-from django.contrib.auth.mixins import LoginRequiredMixin
+from django.contrib.auth.decorators import login_required
+from django.contrib.auth.mixins import LoginRequiredMixin, UserPassesTestMixin
 from django.http import HttpRequest
 from django.shortcuts import get_object_or_404
 from django.template.response import TemplateResponse
@@ -9,7 +10,8 @@
 from .models import Contact
 
 
-def index(request):
+@login_required
+def index(request) -> TemplateResponse:
     return TemplateResponse(request, 'contacts/index.html', {})
 
 
@@ -17,13 +19,13 @@ class ContactListView(LoginRequiredMixin, generic.ListView):
     context_object_name = 'contacts'
 
     def get_queryset(self):
-        return Contact.objects.filter(user=self.request.user)
+        return self.request.user.contacts.all()
 
 
 contact_list = ContactListView.as_view()
 
 
-class ContactCreateView(generic.CreateView):
+class ContactCreateView(LoginRequiredMixin, generic.CreateView):
     model = Contact
     form_class = ContactForm
     success_url = reverse_lazy('contacts:index')
@@ -36,43 +38,55 @@ def get_initial(self):
 contact_add = ContactCreateView.as_view()
 
 
-class ContactDetailView(generic.DetailView):
+class ContactDetailView(LoginRequiredMixin, UserPassesTestMixin, generic.DetailView):
     model = Contact
     context_object_name = 'contact'
 
+    def test_func(self) -> bool | None:
+        return self.get_object().user == self.request.user
+
 
 contact_detail = ContactDetailView.as_view()
 
 
-class ContactUpdateView(generic.UpdateView):
+class ContactUpdateView(LoginRequiredMixin, UserPassesTestMixin, generic.UpdateView):
     model = Contact
     form_class = ContactForm
     extra_context = {'title': 'Edit'}
 
+    def test_func(self) -> bool | None:
+        return self.get_object().user == self.request.user
+
 
 contact_edit = ContactUpdateView.as_view()
 
 
-class ContactDeleteView(generic.DeleteView):
+class ContactDeleteView(LoginRequiredMixin, UserPassesTestMixin, generic.DeleteView):
     model = Contact
     success_url = reverse_lazy('contacts:index')
 
+    def test_func(self) -> bool | None:
+        return self.get_object().user == self.request.user
+
 
 contact_delete = ContactDeleteView.as_view()
 
 
+@login_required
 def contact_search(request: HttpRequest) -> TemplateResponse:
     q = request.GET.get('q', None)
     contacts = []
     if q is not None:
-        contacts = Contact.objects.filter(name__icontains=q)
+        contacts = request.user.contacts.filter(name__icontains=q)
 
     return TemplateResponse(
         request, 'contacts/contact_list.html', {'contacts': contacts}
     )
 
 
+@login_required
 def toggle_favorite(request: HttpRequest, slug: str) -> TemplateResponse:
-    contact: Contact = get_object_or_404(Contact, slug=slug)
+    contact: Contact = get_object_or_404(Contact, slug=slug, user=request.user)
     contact.toggle_favorite()
-    return TemplateResponse(request, 'contacts/favorite.html', {'contact': contact})
+    context = {'contact': contact}
+    return TemplateResponse(request, 'contacts/favorite.html', context)
diff --git a/static/images/star-2763.svg b/static/images/star-2763.svg
deleted file mode 100644
index 68e6979..0000000
--- a/static/images/star-2763.svg
+++ /dev/null
@@ -1,8 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" width="256" height="256" viewBox="0 0 256 256" xml:space="preserve">
-
-<defs>
-</defs>
-<g style="stroke: none; stroke-width: 0; stroke-dasharray: none; stroke-linecap: butt; stroke-linejoin: miter; stroke-miterlimit: 10; fill: none; fill-rule: nonzero; opacity: 1;" transform="translate(1.4065934065934016 1.4065934065934016) scale(2.81 2.81)" >
-	<path d="M 70.845 87.952 c -0.506 0 -1.015 -0.122 -1.484 -0.368 L 45.551 75.065 c -0.346 -0.182 -0.758 -0.182 -1.102 0 L 20.64 87.583 c -1.082 0.568 -2.367 0.476 -3.354 -0.243 c -0.987 -0.718 -1.473 -1.911 -1.267 -3.114 l 4.547 -26.511 c 0.066 -0.384 -0.062 -0.776 -0.341 -1.049 L 0.964 37.891 c -0.874 -0.853 -1.183 -2.104 -0.806 -3.265 c 0.377 -1.162 1.362 -1.992 2.571 -2.167 l 26.619 -3.868 c 0.386 -0.056 0.72 -0.298 0.893 -0.648 L 42.144 3.822 C 42.685 2.727 43.779 2.047 45 2.046 c 1.221 0 2.315 0.68 2.856 1.775 c 0 0 0 0 0 0 L 59.76 27.943 c 0.173 0.349 0.506 0.591 0.893 0.647 l 26.618 3.868 c 1.209 0.176 2.194 1.006 2.571 2.168 c 0.377 1.161 0.068 2.412 -0.806 3.264 L 69.774 56.666 c -0.279 0.272 -0.407 0.664 -0.341 1.048 l 4.547 26.512 c 0.206 1.204 -0.279 2.397 -1.267 3.115 C 72.155 87.746 71.502 87.952 70.845 87.952 z M 45 72.93 c 0.509 0 1.019 0.122 1.482 0.366 l 23.809 12.518 c 0.408 0.214 0.873 0.18 1.247 -0.091 c 0.373 -0.271 0.549 -0.705 0.472 -1.159 l -4.547 -26.511 c -0.178 -1.032 0.164 -2.086 0.915 -2.818 L 87.64 36.458 c 0.33 -0.322 0.442 -0.775 0.3 -1.214 s -0.5 -0.74 -0.956 -0.806 L 60.364 30.57 c -1.037 -0.151 -1.934 -0.802 -2.397 -1.742 L 46.063 4.707 c -0.205 -0.413 -0.602 -0.66 -1.063 -0.66 c -0.461 0 -0.858 0.247 -1.062 0.66 L 32.034 28.828 c -0.464 0.94 -1.361 1.591 -2.398 1.742 L 3.017 34.438 c -0.457 0.066 -0.813 0.367 -0.956 0.806 c -0.143 0.439 -0.031 0.893 0.3 1.214 l 19.262 18.776 c 0.75 0.732 1.093 1.785 0.916 2.818 l -4.547 26.511 c -0.078 0.455 0.098 0.888 0.471 1.159 c 0.373 0.271 0.841 0.305 1.249 0.09 l 23.808 -12.517 C 43.982 73.052 44.491 72.93 45 72.93 z" style="stroke: none; stroke-width: 1; stroke-dasharray: none; stroke-linecap: butt; stroke-linejoin: miter; stroke-miterlimit: 10; fill: rgb(0,0,0); fill-rule: nonzero; opacity: 1;" transform=" matrix(1 0 0 1 0 0) " stroke-linecap="round" />
-</g>
-</svg>
\ No newline at end of file
diff --git a/static/images/star-7207.svg b/static/images/star-7207.svg
deleted file mode 100644
index eab0dd5..0000000
--- a/static/images/star-7207.svg
+++ /dev/null
@@ -1,8 +0,0 @@
-<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1" width="256" height="256" viewBox="0 0 256 256" xml:space="preserve">
-
-<defs>
-</defs>
-<g style="stroke: none; stroke-width: 0; stroke-dasharray: none; stroke-linecap: butt; stroke-linejoin: miter; stroke-miterlimit: 10; fill: none; fill-rule: nonzero; opacity: 1;" transform="translate(1.4065934065934016 1.4065934065934016) scale(2.81 2.81)" >
-	<path d="M 89.95 34.92 c -0.135 -0.411 -0.519 -0.688 -0.95 -0.688 H 56.508 L 45.948 2.814 C 45.811 2.408 45.43 2.133 45 2.133 s -0.811 0.274 -0.948 0.681 l -10.56 31.417 H 1 c -0.432 0 -0.815 0.277 -0.95 0.688 s 0.009 0.861 0.357 1.117 l 26.246 19.314 l -10 31.21 c -0.131 0.409 0.014 0.856 0.36 1.11 c 0.348 0.257 0.817 0.261 1.168 0.012 L 45 68.795 l 26.818 18.889 c 0.173 0.122 0.375 0.183 0.576 0.183 c 0.208 0 0.416 -0.064 0.592 -0.194 c 0.347 -0.254 0.491 -0.701 0.36 -1.11 l -10 -31.21 l 26.246 -19.314 C 89.94 35.781 90.085 35.331 89.95 34.92 z" style="stroke: none; stroke-width: 1; stroke-dasharray: none; stroke-linecap: butt; stroke-linejoin: miter; stroke-miterlimit: 10; fill: rgb(255,212,0); fill-rule: nonzero; opacity: 1;" transform=" matrix(1 0 0 1 0 0) " stroke-linecap="round" />
-</g>
-</svg>
\ No newline at end of file
diff --git a/templates/account/email_confirm.html b/templates/account/email_confirm.html
index ac0891b..01eee79 100644
--- a/templates/account/email_confirm.html
+++ b/templates/account/email_confirm.html
@@ -1,4 +1,4 @@
-{% extends "account/base.html" %}
+{% extends "base.html" %}
 
 {% load i18n %}
 {% load account %}
@@ -13,18 +13,24 @@ <h1>{% trans "Confirm E-mail Address" %}</h1>
 
 {% user_display confirmation.email_address.user as user_display %}
 
-<p>{% blocktrans with confirmation.email_address.email as email %}Please confirm that <a href="mailto:{{ email }}">{{ email }}</a> is an e-mail address for user {{ user_display }}.{% endblocktrans %}</p>
+<p>
+    {% blocktrans with confirmation.email_address.email as email %}Please confirm that
+    <a href="mailto:{{ email }}">{{ email }}</a> is an e-mail address for user {{ user_display }}.{% endblocktrans %}
+</p>
 
 <form method="post" action="{% url 'account_confirm_email' confirmation.key %}">
-{% csrf_token %}
-    <button type="submit">{% trans 'Confirm' %}</button>
+    {% csrf_token %}
+    <button class="btn btn-primary" type="submit">{% trans 'Confirm' %}</button>
 </form>
 
 {% else %}
 
 {% url 'account_email' as email_url %}
 
-<p>{% blocktrans %}This e-mail confirmation link expired or is invalid. Please <a href="{{ email_url }}">issue a new e-mail confirmation request</a>.{% endblocktrans %}</p>
+<p>
+    {% blocktrans %}This e-mail confirmation link expired or is invalid. Please <a href="{{ email_url }}">issue a new
+        e-mail confirmation request</a>.{% endblocktrans %}
+</p>
 
 {% endif %}