feat: Implement filters on time-entries by uuid #154

time_tracker_api/time_entries/time_entries_model.py

@@ -1,8 +1,8 @@
 import abc
 from dataclasses import dataclass, field
 from typing import List, Callable
-
 from azure.cosmos import PartitionKey
+from flask_restplus import abort
 from flask_restplus._http import HTTPStatus
 
 from commons.data_access_layer.cosmos_db import (
@@ -19,7 +19,10 @@
 
 from utils.extend_model import add_project_name_to_time_entries
 from utils import worked_time
-from utils.extend_model import create_in_condition
+from utils.extend_model import (
+    create_in_condition,
+    create_custom_query_from_str,
+)
 
 from time_tracker_api.projects.projects_model import ProjectCosmosDBModel
 from time_tracker_api.projects import projects_model
@@ -123,13 +126,12 @@ def find_all(
         self,
         event_context: EventContext,
         conditions: dict = {},
+        custom_sql_conditions: List[str] = [],
         date_range: dict = {},
     ):
-        custom_sql_conditions = [self.create_sql_date_range_filter(date_range)]
-
-        if event_context.is_admin:
-            conditions.pop("owner_id")
-            # TODO should be removed when implementing a role-based permission module ↑
+        custom_sql_conditions.append(
+            self.create_sql_date_range_filter(date_range)
+        )
 
         custom_params = self.generate_params(date_range)
         time_entries = CosmosDBRepository.find_all(
@@ -297,10 +299,30 @@ def check_time_entry_is_not_started(self, data):
     def get_all(self, conditions: dict = None, **kwargs) -> list:
         event_ctx = self.create_event_context("read-many")
         conditions.update({"owner_id": event_ctx.user_id})
-
+        custom_query = []
+        if "user_id" in conditions:
+            if event_ctx.is_admin:
+                conditions.pop("owner_id")
+                custom_query = (
+                    []
+                    if conditions.get("user_id") == "*"
+                    else [
+                        create_custom_query_from_str(
+                            conditions.get("user_id"), "c.owner_id"
+                        )
+                    ]
+                )
+                conditions.pop("user_id")
+            else:
+                abort(
+                    HTTPStatus.FORBIDDEN, "You don't have enough permissions."
+                )
         date_range = self.handle_date_filter_args(args=conditions)
         return self.repository.find_all(
-            event_ctx, conditions=conditions, date_range=date_range
+            event_ctx,
+            conditions=conditions,
+            custom_sql_conditions=custom_query,
+            date_range=date_range,
         )
 
     def get(self, id):