Only genrequest members can mark an order as seen

src/staff/tables.py

@@ -3,8 +3,12 @@
 import django_tables2 as tables
 from django.db.models import IntegerField
 from django.db.models.functions import Cast
+from django.middleware.csrf import get_token
+from django.urls import reverse
+from django.utils.html import format_html
 from django.utils.safestring import mark_safe
 
+from capps.users.models import User
 from genlab_bestilling.models import (
     AnalysisOrder,
     EquipmentOrder,
@@ -409,13 +413,39 @@ class Meta:
         template_name = "django_tables2/tailwind_inner.html"
 
 
+class UserAwareTemplateColumn(tables.TemplateColumn):
+    def __init__(self, *args, user: User = None, **kwargs) -> str:
+        self.user = user
+        super().__init__(*args, **kwargs)
+
+    def render(self, record: Any, table: tables.Table, **kwargs) -> str:
+        context = self.get_context(record, table, **kwargs)
+        context["user"] = self.user
+        return self.template.render(context)
+
+
 class NewUnseenOrderTable(StaffIDMixinTable):
-    seen = tables.TemplateColumn(
-        orderable=False,
-        verbose_name="Seen",
-        template_name="staff/components/seen_column.html",
-        empty_values=(),
-    )
+    seen = tables.Column(verbose_name="", orderable=False, empty_values=())
+
+    def __init__(self, *args, user: User = None, request: Any = None, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.user = user
+        self.request = request
+
+    def render_seen(self, record: Order) -> str:
+        if record.genrequest.responsible_staff.filter(id=self.user.id).exists():
+            return format_html(
+                """
+                <form method="post" action="{}">
+                    <input type="hidden" name="csrfmiddlewaretoken" value="{}">
+                    <input type="hidden" name="return_to" value="dashboard">
+                    <button class="btn bg-secondary text-white" style="background-color: darkgoldenrod; height: auto;" type="submit">Mark as seen</button>
+                </form>
+                """,  # noqa: E501
+                reverse("staff:mark-as-seen", kwargs={"pk": record.pk}),
+                get_token(self.request),
+            )
+        return ""
 
     description = tables.Column(
         accessor="genrequest__name",

src/staff/templates/staff/components/seen_column.html

@@ -1,5 +1,7 @@
+{% if user %}
 <form method="post" action="{% url 'staff:mark-as-seen' pk=record.id %}">
   {% csrf_token %}
   <input type="hidden" name="return_to" value="dashboard">
   <button class="btn bg-secondary text-white" style="background-color: darkgoldenrod; height: auto;" type="submit">Mark as seen</button>
 </form>
+{% endif %}

src/staff/templates/staff/dashboard.html

@@ -24,7 +24,7 @@
   <div class="grid grid-cols-1 xl:grid-cols-2 gap-8">
     <div class="flex flex-col gap-8">
       {% urgent_orders_table area=area %}
-      {% new_unseen_orders_table area=area %}
+      {% new_unseen_orders_table area=area user=user %}
       {% new_seen_orders_table area=area %}
     </div>
 

src/staff/templatetags/order_tags.py

@@ -1,6 +1,7 @@
 from django import template
 from django.db import models
 
+from capps.users.models import User
 from genlab_bestilling.models import Area, Order
 
 from ..tables import (
@@ -86,7 +87,9 @@ def new_seen_orders_table(context: dict, area: Area | None = None) -> dict:
 
 
 @register.inclusion_tag("staff/components/order_table.html", takes_context=True)
-def new_unseen_orders_table(context: dict, area: Area | None = None) -> dict:
+def new_unseen_orders_table(
+    context: dict, area: Area | None = None, user: User | None = None
+) -> dict:
     new_orders = (
         Order.objects.filter(status=Order.OrderStatus.DELIVERED, is_seen=False)
         .exclude(is_urgent=True)
@@ -113,7 +116,9 @@ def new_unseen_orders_table(context: dict, area: Area | None = None) -> dict:
 
     return {
         "title": "New unseen orders",
-        "table": NewUnseenOrderTable(new_orders),
+        "table": NewUnseenOrderTable(
+            new_orders, user=user, request=context.get("request")
+        ),
         "count": new_orders.count(),
         "request": context.get("request"),
     }