Only genrequest members can mark an order as seen

src/staff/tables.py

@@ -423,10 +423,10 @@ class Meta:
 
 class NewUnseenOrderTable(StaffIDMixinTable):
     seen = tables.TemplateColumn(
+        verbose_name="",
         orderable=False,
-        verbose_name="Seen",
-        template_name="staff/components/seen_column.html",
         empty_values=(),
+        template_name="staff/components/seen_column.html",
     )
 
     description = tables.Column(

src/staff/templates/staff/analysisorder_detail.html

@@ -1,5 +1,6 @@
 {% extends "staff/base.html" %}
 {% load i18n %}
+{% load order_tags %}
 
 
 {% block content %}
@@ -18,7 +19,7 @@ <h3 class="text-4xl mb-5">Order {{ object }}</h3>
 
         <div class="ml-auto"></div>
 
-        {% if not object.is_seen %}
+        {% if object.genrequest.responsible_staff.all|is_responsible:request.user and not object.is_seen %}
             <form method="post" action="{% url 'staff:mark-as-seen' pk=object.id %}">
                 {% csrf_token %}
                 <button class="btn bg-secondary text-white" style="background-color: darkgoldenrod" type="submit">Mark as seen</button>

src/staff/templates/staff/components/seen_column.html

@@ -1,5 +1,11 @@
+{% load order_tags %}
+
+{% if record.genrequest.responsible_staff.all|is_responsible:request.user %}
 <form method="post" action="{% url 'staff:mark-as-seen' pk=record.id %}">
   {% csrf_token %}
   <input type="hidden" name="return_to" value="dashboard">
-  <button class="btn bg-secondary text-white" style="background-color: darkgoldenrod; height: auto;" type="submit">Mark as seen</button>
+  <button class="btn bg-secondary text-white" style="background-color: darkgoldenrod; height: auto;" type="submit">
+    Mark as seen
+  </button>
 </form>
+{% endif %}

src/staff/templates/staff/extractionorder_detail.html

@@ -1,5 +1,6 @@
 {% extends "staff/base.html" %}
 {% load i18n %}
+{% load order_tags %}
 
 
 {% block content %}
@@ -38,7 +39,7 @@ <h3 class="text-4xl mb-5">Order {{ object }}</h3>
 
         <div class="ml-auto"></div>
 
-        {% if not object.is_seen %}
+        {% if object.genrequest.responsible_staff.all|is_responsible:request.user and not object.is_seen %}
             <form method="post" action="{% url 'staff:mark-as-seen' pk=object.id %}">
                 {% csrf_token %}
                 <button class="btn bg-secondary text-white" style="background-color: darkgoldenrod" type="submit">Mark as seen</button>

src/staff/templatetags/order_tags.py

@@ -1,6 +1,7 @@
 from django import template
 from django.db import models
 
+from capps.users.models import User
 from genlab_bestilling.models import Area, Order
 
 from ..tables import (
@@ -14,6 +15,11 @@
 register = template.Library()
 
 
+@register.filter
+def is_responsible(staff_queryset: models.QuerySet, user: User) -> bool:
+    return staff_queryset.filter(id=user.id).exists()
+
+
 @register.inclusion_tag("staff/components/order_table.html", takes_context=True)
 def urgent_orders_table(context: dict, area: Area | None = None) -> dict:
     urgent_orders = (

src/staff/views.py

@@ -190,6 +190,17 @@ def get_object(self) -> Order:
     def post(self, request: HttpRequest, *args, **kwargs) -> HttpResponse:
         try:
             order = self.get_object()
+
+            if not order.genrequest.responsible_staff.filter(
+                id=request.user.id
+            ).exists():
+                messages.error(
+                    request, _("You are not authorized to mark this order as seen.")
+                )
+                return HttpResponseRedirect(
+                    self.get_return_url(request.POST.get("return_to"))
+                )
+
             order.toggle_seen()
             messages.success(request, _("Order is marked as seen"))
         except Exception as e: