Add permissions based on department

back/admin/admin_tasks/forms.py

@@ -1,7 +1,11 @@
 from django import forms
 from django.utils.translation import gettext_lazy as _
 
-from users.models import User
+from users.selectors import (
+    get_all_managers_and_admins_for_departments_of_user,
+    get_all_managers_and_admins_for_departments_of_user_with_slack,
+    get_all_new_hires_for_departments_of_user,
+)
 
 from .models import AdminTask, AdminTaskComment
 
@@ -14,40 +18,32 @@ class Meta:
         ]
 
 
-class AdminTaskUpdateForm(forms.ModelForm):
-    def __init__(self, *args, **kwargs):
-        super().__init__(*args, **kwargs)
-        instance = getattr(self, "instance", None)
-        if instance is not None and instance.completed:
-            for field in self.fields:
-                self.fields[field].widget.attrs["disabled"] = True
-
-    class Meta:
-        model = AdminTask
-        fields = ["name", "assigned_to", "date", "priority"]
-
-
 class AdminTaskCreateForm(forms.ModelForm):
     comment = forms.CharField(label=_("Comment"), max_length=12500)
-    new_hire = forms.ModelChoiceField(
-        label=_("New hire"), queryset=User.new_hires.all()
-    )
-    assigned_to = forms.ModelChoiceField(
-        label=_("Assigned to"), queryset=User.admins.all()
-    )
-    slack_user = forms.ModelChoiceField(
-        label=_("Slack user"), queryset=User.managers_and_admins.with_slack()
-    )
     date = forms.DateField(
         label=_("Date"),
         required=False,
         widget=forms.DateInput(attrs={"type": "date"}, format=("%Y-%m-%d")),
     )
 
     def __init__(self, *args, **kwargs):
+        user = kwargs.pop("user")
         super().__init__(*args, **kwargs)
-        self.fields["option"].initial = 0
-        self.fields["slack_user"].required = False
+        if "option" in self.fields:
+            self.fields["option"].initial = 0
+        if "new_hire" in self.fields:
+            self.fields[
+                "new_hire"
+            ].queryset = get_all_new_hires_for_departments_of_user(user=user)
+        self.fields[
+            "assigned_to"
+        ].queryset = get_all_managers_and_admins_for_departments_of_user(user=user)
+        if "slack_user" in self.fields:
+            self.fields[
+                "slack_user"
+            ].queryset = get_all_managers_and_admins_for_departments_of_user_with_slack(
+                user=user
+            )
 
     class Meta:
         model = AdminTask
@@ -62,3 +58,16 @@ class Meta:
             "slack_user",
             "email",
         ]
+
+
+class AdminTaskUpdateForm(AdminTaskCreateForm):
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        instance = getattr(self, "instance", None)
+        if instance is not None and instance.completed:
+            for field in self.fields:
+                self.fields[field].widget.attrs["disabled"] = True
+
+    class Meta:
+        model = AdminTask
+        fields = ["name", "assigned_to", "date", "priority"]

back/admin/admin_tasks/models.py

@@ -1,5 +1,6 @@
 from django.conf import settings
 from django.db import models
+from django.db.models import Q
 from django.template.loader import render_to_string
 from django.utils.translation import gettext_lazy as _
 
@@ -13,7 +14,24 @@
 )
 
 
-class AminTaskManager(models.Manager):
+class FilteredForAdminQuerySet(models.QuerySet):
+    def for_user(self, user):
+        if user.is_manager:
+            return self.filter(
+                Q(new_hire__departments__isnull=True)
+                | Q(new_hire__departments__in=user.departments.all())
+            )
+        else:
+            return self
+
+
+class AdminTaskManager(models.Manager):
+    def for_user(self, user):
+        return self.get_queryset().for_user(user)
+
+    def get_queryset(self):
+        return FilteredForAdminQuerySet(self.model, using=self._db)
+
     def create_admin_task(
         self,
         new_hire,
@@ -125,7 +143,7 @@ class Notification(models.IntegerChoices):
         help_text=_("Only set if generated based on hardware."),
     )
 
-    objects = AminTaskManager()
+    objects = AdminTaskManager()
 
     def get_icon_template(self):
         return render_to_string("_admin_task_icon.html")

back/admin/admin_tasks/selectors.py

@@ -0,0 +1,10 @@
+from admin.admin_tasks.models import AdminTask
+from users.models import User
+
+
+def get_admin_tasks_for_department(*, user: User):
+    return AdminTask.objects.for_user(user=user)
+
+
+def get_admin_tasks_for_user(*, user: User):
+    return AdminTask.objects.filter(assigned_to=user)

back/admin/admin_tasks/views.py

@@ -7,18 +7,23 @@
 from django.views.generic.edit import CreateView, UpdateView
 from django.views.generic.list import ListView
 
-from users.mixins import ManagerPermMixin
+from admin.admin_tasks.selectors import (
+    get_admin_tasks_for_department,
+    get_admin_tasks_for_user,
+)
+from misc.mixins import FormWithUserContextMixin
+from users.mixins import AdminOrManagerPermMixin
 
 from .forms import AdminTaskCommentForm, AdminTaskCreateForm, AdminTaskUpdateForm
 from .models import AdminTask, AdminTaskComment
 
 
-class MyAdminTasksListView(ManagerPermMixin, ListView):
+class MyAdminTasksListView(AdminOrManagerPermMixin, ListView):
     template_name = "admin_tasks_yours.html"
     paginate_by = 10
 
     def get_queryset(self):
-        return AdminTask.objects.filter(assigned_to=self.request.user).select_related(
+        return get_admin_tasks_for_user(user=self.request.user).select_related(
             "new_hire", "assigned_to"
         )
 
@@ -30,12 +35,14 @@ def get_context_data(self, **kwargs):
         return context
 
 
-class AllAdminTasksListView(ManagerPermMixin, ListView):
+class AllAdminTasksListView(AdminOrManagerPermMixin, ListView):
     template_name = "admin_tasks_all.html"
     paginate_by = 10
 
     def get_queryset(self):
-        return AdminTask.objects.all().select_related("new_hire", "assigned_to")
+        return get_admin_tasks_for_department(user=self.request.user).select_related(
+            "new_hire", "assigned_to"
+        )
 
     def get_context_data(self, **kwargs):
         context = super().get_context_data(**kwargs)
@@ -45,16 +52,19 @@ def get_context_data(self, **kwargs):
         return context
 
 
-class AdminTaskCompleteView(ManagerPermMixin, BaseDetailView):
-    model = AdminTask
+class AdminTaskCompleteView(AdminOrManagerPermMixin, BaseDetailView):
+    def get_queryset(self):
+        return get_admin_tasks_for_department(user=self.request.user)
 
     def post(self, request, *args, **kwargs):
         admin_task = self.get_object()
         admin_task.mark_completed()
         return redirect("admin_tasks:detail", pk=admin_task.id)
 
 
-class AdminTasksCreateView(ManagerPermMixin, SuccessMessageMixin, CreateView):
+class AdminTasksCreateView(
+    AdminOrManagerPermMixin, FormWithUserContextMixin, SuccessMessageMixin, CreateView
+):
     template_name = "admin_tasks_create.html"
     form_class = AdminTaskCreateForm
     model = AdminTask
@@ -83,18 +93,26 @@ def get_context_data(self, **kwargs):
         return context
 
 
-class AdminTasksUpdateView(ManagerPermMixin, SuccessMessageMixin, UpdateView):
+class AdminTasksUpdateView(AdminOrManagerPermMixin, SuccessMessageMixin, UpdateView):
     template_name = "admin_tasks_detail.html"
     form_class = AdminTaskUpdateForm
     model = AdminTask
     success_message = _("Task has been updated")
 
+    def get_form_kwargs(self):
+        kwargs = super().get_form_kwargs()
+        kwargs["user"] = self.get_object().new_hire
+        return kwargs
+
+    def get_queryset(self):
+        return get_admin_tasks_for_department(user=self.request.user)
+
     def get_success_url(self):
         return self.request.path
 
     def get_context_data(self, **kwargs):
         context = super().get_context_data(**kwargs)
-        task = get_object_or_404(AdminTask, pk=self.kwargs.get("pk"))
+        task = self.get_object()
         context["object"] = task
         context["title"] = _("Task: %(name)s") % {"name": task.name}
         context["subtitle"] = _("Tasks")
@@ -103,7 +121,8 @@ def get_context_data(self, **kwargs):
 
     def form_valid(self, form):
         # send email/bot message to newly assigned person
-        initial_assigned_to = AdminTask.objects.get(id=form.instance.id).assigned_to
+        task = self.get_object()
+        initial_assigned_to = task.assigned_to
         form.save()
         if (
             form.cleaned_data["assigned_to"] != initial_assigned_to
@@ -113,7 +132,9 @@ def form_valid(self, form):
         return super().form_valid(form)
 
 
-class AdminTasksCommentCreateView(ManagerPermMixin, SuccessMessageMixin, CreateView):
+class AdminTasksCommentCreateView(
+    AdminOrManagerPermMixin, SuccessMessageMixin, CreateView
+):
     template_name = "admin_tasks_detail.html"
     model = AdminTaskComment
     fields = [
@@ -122,11 +143,13 @@ class AdminTasksCommentCreateView(ManagerPermMixin, SuccessMessageMixin, CreateV
     success_message = _("Comment has been posted")
 
     def get_success_url(self):
-        task = get_object_or_404(AdminTask, pk=self.kwargs.get("pk"))
-        return reverse("admin_tasks:detail", args=[task.id])
+        return reverse("admin_tasks:detail", args=[self.object.admin_task.id])
 
     def form_valid(self, form):
-        task = get_object_or_404(AdminTask, pk=self.kwargs.get("pk"))
+        task = get_object_or_404(
+            get_admin_tasks_for_department(user=self.request.user),
+            pk=self.kwargs.get("pk"),
+        )
         # Can't post comments when item is completed
         if task.completed:
             raise Http404

back/admin/appointments/forms.py

@@ -4,11 +4,12 @@
 from django.utils.translation import gettext_lazy as _
 
 from admin.templates.forms import MultiSelectField, TagModelForm, WYSIWYGField
+from misc.mixins import FilterDepartmentFieldByUserMixin
 
 from .models import Appointment
 
 
-class AppointmentForm(TagModelForm):
+class AppointmentForm(FilterDepartmentFieldByUserMixin, TagModelForm):
     content = WYSIWYGField()
     date = forms.DateField(
         label=_("Date"),
@@ -27,6 +28,7 @@ def __init__(self, *args, **kwargs):
             Div(
                 Div(
                     Field("name"),
+                    Field("departments"),
                     MultiSelectField("tags"),
                     Field("fixed_date"),
                     Div(
@@ -62,7 +64,16 @@ def clean(self):
 
     class Meta:
         model = Appointment
-        exclude = ("template",)
+        fields = (
+            "fixed_date",
+            "on_day",
+            "time",
+            "date",
+            "name",
+            "tags",
+            "content",
+            "departments",
+        )
         widgets = {
             "time": forms.TimeInput(attrs={"type": "time", "step": 300}),
         }

back/admin/appointments/migrations/0009_alter_appointment_options_appointment_departments.py

@@ -0,0 +1,26 @@
+# Generated by Django 5.2.6 on 2025-09-23 02:35
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("appointments", "0008_auto_20220221_1338"),
+        ("users", "0043_remove_user_department_user_departments_and_more"),
+    ]
+
+    operations = [
+        migrations.AlterModelOptions(
+            name="appointment",
+            options={"ordering": ("name",)},
+        ),
+        migrations.AddField(
+            model_name="appointment",
+            name="departments",
+            field=models.ManyToManyField(
+                blank=True,
+                help_text="Leave empty to make it available for all managers/admins",
+                to="users.department",
+            ),
+        ),
+    ]

back/admin/appointments/selectors.py

@@ -0,0 +1,6 @@
+from admin.appointments.models import Appointment
+from users.models import User
+
+
+def get_appointment_templates_for_user(*, user: User):
+    return Appointment.templates.for_user(user=user)