Merge release branch 24.10 to develop

individual/gql_mutations.py

@@ -1,6 +1,8 @@
 import graphene
-from django.core.exceptions import ValidationError
+from django.core.exceptions import ValidationError, PermissionDenied
 from django.db import transaction
+from django.db.models import Subquery, Q
+from django.utils.translation import gettext as _
 
 from core.gql.gql_mutations.base_mutation import BaseHistoryModelDeleteMutationMixin, BaseMutation, \
     BaseHistoryModelUpdateMutationMixin, BaseHistoryModelCreateMutationMixin
@@ -9,13 +11,15 @@
 from individual.models import Individual, Group, GroupIndividual
 from individual.services import IndividualService, GroupService, GroupIndividualService, \
     CreateGroupAndMoveIndividualService
+from location.models import Location, LocationManager
 
 
 class CreateIndividualInputType(OpenIMISMutation.Input):
     first_name = graphene.String(required=True, max_length=255)
     last_name = graphene.String(required=True, max_length=255)
     dob = graphene.Date(required=True)
     json_ext = graphene.types.json.JSONString(required=False)
+    location_id = graphene.Int(required=False)
 
 
 class UpdateIndividualInputType(CreateIndividualInputType):
@@ -55,6 +59,7 @@ def resolve_recipient_type(self, info):
 class CreateGroupInputType(OpenIMISMutation.Input):
     code = graphene.String(required=True)
     individuals_data = graphene.List(CreateGroupIndividualInputTypeInputObjectType, required=False)
+    location_id = graphene.Int(required=False)
 
 
 class UpdateGroupInputType(CreateGroupInputType):
@@ -81,7 +86,15 @@ def _validate_mutation(cls, user, **data):
         super()._validate_mutation(user, **data)
         if not user.has_perms(
                 IndividualConfig.gql_individual_create_perms):
-            raise ValidationError("mutation.authentication_required")
+            raise PermissionDenied(_("unauthorized"))
+        if (
+            'location_id' in data and
+            not LocationManager().is_allowed(
+                user,
+                [data['location_id']]
+            )
+        ):
+            raise PermissionDenied(_("unauthorized.location"))
 
     @classmethod
     def _mutate(cls, user, **data):
@@ -108,7 +121,21 @@ def _validate_mutation(cls, user, **data):
         super()._validate_mutation(user, **data)
         if not user.has_perms(
                 IndividualConfig.gql_individual_update_perms):
-            raise ValidationError("mutation.authentication_required")
+            raise PermissionDenied(_("unauthorized"))
+
+        location_from = Individual.objects.get(id=data['id']).location_id
+
+        location_to_check = [data['location_id']] if 'location_id' in data else []
+        if location_from:
+            location_to_check.append(location_from)
+        if (
+            len(location_to_check)>0 and
+            not LocationManager().is_allowed(
+                user,
+                location_to_check
+            )
+        ):
+            raise PermissionDenied(_("unauthorized.location"))
 
     @classmethod
     def _mutate(cls, user, **data):
@@ -138,7 +165,14 @@ def _validate_mutation(cls, user, **data):
         super()._validate_mutation(user, **data)
         if not user.has_perms(
                 IndividualConfig.gql_individual_delete_perms):
-            raise ValidationError("mutation.authentication_required")
+            raise PermissionDenied(_("unauthorized"))
+
+        locations_id = list(Location.objects.filter(individuals__id__in=data['ids']).values_list('id', flat=True))
+        if len(locations_id)>0 and not LocationManager().is_allowed(
+                user,
+                locations_id
+        ):
+            raise PermissionDenied(_("unauthorized.location"))
 
     @classmethod
     def _mutate(cls, user, **data):
@@ -152,8 +186,8 @@ def _mutate(cls, user, **data):
         ids = data.get('ids')
         if ids:
             with transaction.atomic():
-                for id in ids:
-                    obj_data = {'id': id}
+                for identifier in ids:
+                    obj_data = {'id': identifier}
                     if IndividualConfig.check_individual_delete:
                         service.create_delete_task(obj_data)
                     else:
@@ -173,7 +207,14 @@ def _validate_mutation(cls, user, **data):
         super()._validate_mutation(user, **data)
         if not user.has_perms(
                 IndividualConfig.gql_individual_undo_delete_perms):
-            raise ValidationError("mutation.authentication_required")
+            raise PermissionDenied(_("unauthorized"))
+
+        locations_id = list(Location.objects.filter(individuals__id__in=data['ids']).values_list('id', flat=True))
+        if len(locations_id)>0 and not LocationManager().is_allowed(
+                user,
+                locations_id
+        ):
+            raise PermissionDenied(_("unauthorized.location"))
 
     @classmethod
     def _mutate(cls, user, **data):
@@ -187,8 +228,8 @@ def _mutate(cls, user, **data):
         ids = data.get('ids')
         if ids:
             with transaction.atomic():
-                for id in ids:
-                    service.undo_delete({'id': id})
+                for identifier in ids:
+                    service.undo_delete({'id': identifier})
 
     class Input(OpenIMISMutation.Input):
         ids = graphene.List(graphene.UUID)
@@ -204,8 +245,15 @@ def _validate_mutation(cls, user, **data):
         super()._validate_mutation(user, **data)
         if not user.has_perms(
                 IndividualConfig.gql_group_create_perms):
-            raise ValidationError("mutation.authentication_required")
-
+            raise PermissionDenied(_("unauthorized"))
+        if (
+            'location_id' in data and
+            not LocationManager().is_allowed(
+                user,
+                [data['location_id']]
+            )
+        ):
+            raise PermissionDenied(_("unauthorized.location"))
     @classmethod
     def _mutate(cls, user, **data):
         if "client_mutation_id" in data:
@@ -231,8 +279,18 @@ def _validate_mutation(cls, user, **data):
         super()._validate_mutation(user, **data)
         if not user.has_perms(
                 IndividualConfig.gql_group_update_perms):
-            raise ValidationError("mutation.authentication_required")
-
+            raise PermissionDenied(_("unauthorized"))
+        location_from = Group.objects.get(id=data['id']).location_id
+        location_to_check = [data['location_id']] if 'location_id' in data else []
+        if location_from:
+            location_to_check.append(location_from)
+        if (
+            len(location_to_check)>0 and not LocationManager().is_allowed(
+                user,
+                location_to_check
+            )
+        ):
+            raise PermissionDenied(_("unauthorized.location"))
     @classmethod
     def _mutate(cls, user, **data):
         if "client_mutation_id" in data:
@@ -258,8 +316,14 @@ def _validate_mutation(cls, user, **data):
         super()._validate_mutation(user, **data)
         if not user.has_perms(
                 IndividualConfig.gql_group_delete_perms):
-            raise ValidationError("mutation.authentication_required")
-
+            raise PermissionDenied(_("unauthorized"))
+
+        locations_id = list(Location.objects.filter(groups__id__in=data['ids']).values_list('id', flat=True))
+        if len(locations_id)>0 and not LocationManager().is_allowed(
+                user,
+                locations_id
+        ):
+            raise PermissionDenied(_("unauthorized.location"))
     @classmethod
     def _mutate(cls, user, **data):
         if "client_mutation_id" in data:
@@ -272,8 +336,8 @@ def _mutate(cls, user, **data):
         ids = data.get('ids')
         if ids:
             with transaction.atomic():
-                for id in ids:
-                    service.delete({'id': id, 'user': user})
+                for identifier in ids:
+                    service.delete({'id': identifier})
 
     class Input(OpenIMISMutation.Input):
         ids = graphene.List(graphene.UUID)
@@ -289,7 +353,22 @@ def _validate_mutation(cls, user, **data):
         super()._validate_mutation(user, **data)
         if not user.has_perms(
                 IndividualConfig.gql_group_create_perms):
-            raise ValidationError("mutation.authentication_required")
+            raise PermissionDenied(_("unauthorized"))
+        group_location_id = Group.objects.get(id=data['group_id']).location_id
+        individual_location_id = Individual.objects.get(id=data['individual_id']).location_id
+        location_to_check = []
+        if group_location_id:
+            location_to_check.append(group_location_id)
+        if individual_location_id:
+            location_to_check.append(individual_location_id)
+        if len(location_to_check)>0 and not LocationManager().is_allowed(
+                user,
+                location_to_check
+        ):
+            raise PermissionDenied(_("unauthorized.location"))
+
+        if group_location_id and individual_location_id and group_location_id != individual_location_id:
+            raise ValidationError(_("mutation.individual_group_location_mismatch"))
 
     @classmethod
     def _mutate(cls, user, **data):
@@ -316,7 +395,23 @@ def _validate_mutation(cls, user, **data):
         super()._validate_mutation(user, **data)
         if not user.has_perms(
                 IndividualConfig.gql_group_update_perms):
-            raise ValidationError("mutation.authentication_required")
+            raise PermissionDenied(_("unauthorized"))
+
+        group_location_id = Group.objects.get(id=data['group_id']).location_id
+        individual_location_id = Individual.objects.get(id=data['individual_id']).location_id
+        location_to_check = []
+        if individual_location_id:
+            location_to_check.append(individual_location_id)
+        if group_location_id:
+            location_to_check.append(group_location_id)
+        if len(location_to_check)>0 and not LocationManager().is_allowed(
+                user,
+                location_to_check
+        ):
+            raise PermissionDenied(_("unauthorized.location"))
+
+        if group_location_id and individual_location_id and group_location_id != individual_location_id:
+            raise ValidationError(_("mutation.individual_group_location_mismatch"))
 
     @classmethod
     def _mutate(cls, user, **data):
@@ -346,8 +441,17 @@ def _validate_mutation(cls, user, **data):
         super()._validate_mutation(user, **data)
         if not user.has_perms(
                 IndividualConfig.gql_group_delete_perms):
-            raise ValidationError("mutation.authentication_required")
-
+            raise PermissionDenied(_("unauthorized"))
+        locations_qs = list(Location.objects.filter(
+            Q(groups__groupindividuals__id__in=data['ids'])|
+            Q(individuals__groupindividuals__id__in=data['ids'])
+        ).values_list('id', flat=True))
+        # must first check if locations_qs exists in case none of the groups or individuals has location
+        if len(locations_qs)>0 and not LocationManager().is_allowed(
+                user,
+                locations_qs
+        ):
+            raise PermissionDenied(_("unauthorized.location"))
     @classmethod
     def _mutate(cls, user, **data):
         if "client_mutation_id" in data:
@@ -360,8 +464,8 @@ def _mutate(cls, user, **data):
         ids = data.get('ids')
         if ids:
             with transaction.atomic():
-                for id in ids:
-                    service.delete({'id': id, 'user': user})
+                for identifier in ids:
+                    service.delete({'id': identifier})
 
     class Input(OpenIMISMutation.Input):
         ids = graphene.List(graphene.UUID)
@@ -377,7 +481,7 @@ def _validate_mutation(cls, user, **data):
         super()._validate_mutation(user, **data)
         if not user.has_perms(
                 IndividualConfig.gql_group_create_perms):
-            raise ValidationError("mutation.authentication_required")
+            raise PermissionDenied(_("unauthorized"))
 
     @classmethod
     def _mutate(cls, user, **data):
@@ -405,7 +509,7 @@ def _validate_mutation(cls, user, **data):
 
         required_perms = IndividualConfig.gql_group_create_perms + IndividualConfig.gql_group_update_perms
         if not user.has_perms(required_perms):
-            raise ValidationError("mutation.authentication_required")
+            raise PermissionDenied(_("unauthorized"))
 
     @classmethod
     def _mutate(cls, user, **data):
@@ -435,7 +539,7 @@ def _validate_mutation(cls, user, **data):
         super()._validate_mutation(user, **data)
         if not user.has_perms(
                 IndividualConfig.gql_group_create_perms):
-            raise ValidationError("mutation.authentication_required")
+            raise PermissionDenied(_("unauthorized"))
 
     @classmethod
     def _mutate(cls, user, **data):
@@ -469,7 +573,7 @@ def _validate_mutation(cls, user, **data):
         super()._validate_mutation(user, **data)
         if not user.has_perms(
                 IndividualConfig.gql_group_create_perms):
-            raise ValidationError("mutation.authentication_required")
+            raise PermissionDenied(_("unauthorized"))
 
     @classmethod
     def _mutate(cls, user, **data):

individual/gql_queries.py

@@ -1,6 +1,7 @@
 import graphene
 from django.contrib.auth.models import AnonymousUser
 from graphene_django import DjangoObjectType
+import graphene_django_optimizer as gql_optimizer
 
 from core import prefix_filterset, ExtendedConnection
 from core.gql_queries import UserGQLType
@@ -43,6 +44,10 @@ class Meta:
         }
         connection_class = ExtendedConnection
 
+    @classmethod
+    def get_queryset(cls, queryset, info):
+        return Individual.get_queryset(queryset, info.context.user)
+
 
 class IndividualHistoryGQLType(DjangoObjectType):
     uuid = graphene.String(source='uuid')
@@ -68,6 +73,13 @@ class Meta:
         }
         connection_class = ExtendedConnection
 
+    @classmethod
+    def get_queryset(cls, queryset, info):
+        accessible_individual_query = Individual.get_queryset(None, info.context.user)
+        accessible_individuals = gql_optimizer.query(accessible_individual_query, info)
+        accessible_uuids = set(accessible_individuals.values_list('uuid', flat=True))
+        return queryset.filter(id__in=accessible_uuids)
+
 
 class IndividualDataSourceUploadGQLType(DjangoObjectType):
     uuid = graphene.String(source='uuid')
@@ -132,6 +144,10 @@ class Meta:
         }
         connection_class = ExtendedConnection
 
+    @classmethod
+    def get_queryset(cls, queryset, info):
+        return Group.get_queryset(queryset, info.context.user)
+
 
 class GroupHistoryGQLType(DjangoObjectType):
     uuid = graphene.String(source='uuid')
@@ -161,6 +177,13 @@ class Meta:
         }
         connection_class = ExtendedConnection
 
+    @classmethod
+    def get_queryset(cls, queryset, info):
+        accessible_group_query = Group.get_queryset(None, info.context.user)
+        accessible_groups = gql_optimizer.query(accessible_group_query, info)
+        accessible_uuids = set(accessible_groups.values_list('uuid', flat=True))
+        return queryset.filter(id__in=accessible_uuids)
+
 
 class GroupIndividualGQLType(DjangoObjectType):
     uuid = graphene.String(source='uuid')
@@ -181,6 +204,10 @@ class Meta:
         }
         connection_class = ExtendedConnection
 
+    @classmethod
+    def get_queryset(cls, queryset, info):
+        return GroupIndividual.get_queryset(queryset, info.context.user)
+
 
 class GroupIndividualHistoryGQLType(DjangoObjectType):
     uuid = graphene.String(source='uuid')
@@ -205,6 +232,13 @@ class Meta:
         }
         connection_class = ExtendedConnection
 
+    @classmethod
+    def get_queryset(cls, queryset, info):
+        accessible_group_query = Group.get_queryset(None, info.context.user)
+        accessible_groups = gql_optimizer.query(accessible_group_query, info)
+        accessible_uuids = set(accessible_groups.values_list('uuid', flat=True))
+        return queryset.filter(group__id__in=accessible_uuids)
+
 
 class IndividualDataUploadQGLType(DjangoObjectType, JsonExtMixin):
     uuid = graphene.String(source='uuid')