10773533149

Committed 09 Sep 2024 12:48PM UTC coverage: 67.307% (-0.1%) from 67.407%

Build # 10773533149

Build Type

Pull #1152

github

Committed by

joshuaunity

Commit Message

refactor: toast behaviour

prevent toast form destroy on auto-hide until close button is clicked

Signed-off-by: joshuaunity <oghenerobojosh01@gmail.com>

Pull Request Pull Request #1152: Feat edit account

Run Details

6162 of 10005 branches covered (61.59%)

Branch coverage included in aggregate %.

26 of 61 new or added lines in 5 files covered. (42.62%)

1 existing line in 1 file now uncovered.

7784 of 10715 relevant lines covered (72.65%)

5.75 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

69.48

/flexmeasures/api/v3_0/accounts.py

from __future__ import annotations

from flask_classful import FlaskView, route
from flexmeasures.data import db
from webargs.flaskparser import use_kwargs, use_args
from flask_security import current_user, auth_required
from flask_json import as_json

from flexmeasures.auth.policy import user_has_admin_access
from flexmeasures.auth.decorators import permission_required_for_context
from flexmeasures.data.models.audit_log import AuditLog
from flexmeasures.data.models.user import Account
from flexmeasures.data.services.accounts import get_accounts, get_audit_log_records
from flexmeasures.api.common.schemas.users import AccountIdField
from flexmeasures.data.schemas.account import AccountSchema
from flexmeasures.utils.time_utils import server_now

"""
API endpoints to manage accounts.

Both POST (to create) and DELETE are not accessible via the API, but as CLI functions.
Editing (PATCH) is also not yet implemented, but might be next, e.g. for the name or roles.
"""

# Instantiate schemas outside of endpoint logic to minimize response time
account_schema = AccountSchema()
accounts_schema = AccountSchema(many=True)
partial_account_schema = AccountSchema(partial=True)


class AccountAPI(FlaskView):
    route_base = "/accounts"
    trailing_slash = False
    decorators = [auth_required()]

    @route("", methods=["GET"])
    @as_json
    def index(self):
        """API endpoint to list all accounts accessible to the current user.

        .. :quickref: Account; Download account list

        This endpoint returns all accessible accounts.
        Accessible accounts are your own account and accounts you are a consultant for, or all accounts for admins.

        **Example response**

        An example of one account being returned:

        .. sourcecode:: json

            [
                {
                    'id': 1,
                    'name': 'Test Account'
                    'account_roles': [1, 3],
                    'consultancy_account_id': 2,
                }
            ]

        :reqheader Authorization: The authentication token
        :reqheader Content-Type: application/json
        :resheader Content-Type: application/json
        :status 200: PROCESSED
        :status 400: INVALID_REQUEST
        :status 401: UNAUTHORIZED
        :status 403: INVALID_SENDER
        :status 422: UNPROCESSABLE_ENTITY
        """
        if user_has_admin_access(current_user, "read"):
            accounts = get_accounts()
        else:
            accounts = [current_user.account] + (
                current_user.account.consultancy_client_accounts
                if "consultant" in current_user.roles
                else []
            )

        return accounts_schema.dump(accounts), 200

    @route("/<id>", methods=["GET"])
    @use_kwargs({"account": AccountIdField(data_key="id")}, location="path")
    @permission_required_for_context("read", ctx_arg_name="account")
    @as_json
    def get(self, id: int, account: Account):
        """API endpoint to get an account.

        .. :quickref: Account; Get an account

        This endpoint retrieves an account, given its id.
        Only admins, consultants and users belonging to the account itself can use this endpoint.

        **Example response**

        .. sourcecode:: json

            {
                'id': 1,
                'name': 'Test Account'
                'account_roles': [1, 3],
                'consultancy_account_id': 2,
            }

        :reqheader Authorization: The authentication token
        :reqheader Content-Type: application/json
        :resheader Content-Type: application/json
        :status 200: PROCESSED
        :status 400: INVALID_REQUEST, REQUIRED_INFO_MISSING, UNEXPECTED_PARAMS
        :status 401: UNAUTHORIZED
        :status 403: INVALID_SENDER
        :status 422: UNPROCESSABLE_ENTITY
        """

        return account_schema.dump(account), 200

    @route("/<id>", methods=["PATCH"])
    @use_args(partial_account_schema)
    @use_kwargs({"account": AccountIdField(data_key="id")}, location="path")
    @permission_required_for_context("update", ctx_arg_name="account")
    @as_json
    def patch(self, account_data: dict, id: int, account: Account):
        """Update an account given its identifier.

        .. :quickref: Account; Update an account

        This endpoint sets data for an existing account.

        The following fields are not allowed to be updated:
        - id

        The following fields are only editable if user role is admin:
        - consultancy_account_id

        **Example request**

        .. sourcecode:: json

            {
                'name': 'Test Account'
                'primary_color': '#1a3443'
                'secondary_color': '#f1a122'
                'logo_url': 'https://example.com/logo.png'
                'consultancy_account_id': 2,
            }


        **Example response**

        The whole account is returned in the response:

        .. sourcecode:: json

            {
                'id': 1,
                'name': 'Test Account'
                'account_roles': [1, 3],
                'primary_color': '#1a3443'
                'secondary_color': '#f1a122'
                'logo_url': 'https://example.com/logo.png'
                'consultancy_account_id': 2,
            }

        :reqheader Authorization: The authentication token
        :reqheader Content-Type: application/json
        :resheader Content-Type: application/json
        :status 200: UPDATED
        :status 400: INVALID_REQUEST, REQUIRED_INFO_MISSING, UNEXPECTED_PARAMS
        :status 401: UNAUTHORIZED
        :status 403: INVALID_SENDER
        :status 422: UNPROCESSABLE_ENTITY
        """

        # Get existing consultancy_account_id
        existing_consultancy_account_id = (
            account.consultancy_account.id if account.consultancy_account else None
        )

        if not user_has_admin_access(current_user, "update"):
            # Remove consultancy_account_id from account_data if no admin access
            account_data.pop("consultancy_account_id", None)
        else:
            # Check if consultancy_account_id has changed
            new_consultancy_account_id = account_data.get("consultancy_account_id")
            if existing_consultancy_account_id != new_consultancy_account_id:
                new_consultant_account = db.session.query(Account).get(
                    new_consultancy_account_id
                )
                # Validate new consultant account
                if (
                    not new_consultant_account
                    or new_consultant_account.id == account.id
                ):
                    return {"errors": ["Invalid consultancy_account_id"]}, 422

        # Track modified fields
        fields_to_check = [
            "name",
            "primary_color",
            "secondary_color",
            "logo_url",
            "consultancy_account_id",
        ]

        # Compile modified fields string
        modified_fields_str = ", ".join(
            field
            for field in fields_to_check
            if account_data.get(field) != getattr(account, field)
        )

        for k, v in account_data.items():
            setattr(account, k, v)

        event_message = f"Account {account.name} has been updated. Modified fields: {modified_fields_str}"

        # Add Audit log
        account_audit_log = AuditLog(
            event_datetime=server_now(),
            event=event_message,
            active_user_id=current_user.id,
            active_user_name=current_user.username,
            affected_user_id=current_user.id,
            affected_account_id=account.id,
        )
        db.session.add(account_audit_log)
        db.session.commit()
        return account_schema.dump(account), 200

    @route("/<id>/auditlog", methods=["GET"])
    @use_kwargs({"account": AccountIdField(data_key="id")}, location="path")
    @permission_required_for_context(
        "read",
        ctx_arg_name="account",
        pass_ctx_to_loader=True,
        ctx_loader=AuditLog.account_table_acl,
    )
    @as_json
    def auditlog(self, id: int, account: Account):
        """API endpoint to get history of account actions.
        **Example response**

        .. sourcecode:: json
            [
                {
                    'event': 'User test user deleted',
                    'event_datetime': '2021-01-01T00:00:00',
                    'active_user_id': 1,
                }
            ]

        :reqheader Authorization: The authentication token
        :reqheader Content-Type: application/json
        :resheader Content-Type: application/json
        :status 200: PROCESSED
        :status 400: INVALID_REQUEST, REQUIRED_INFO_MISSING, UNEXPECTED_PARAMS
        :status 401: UNAUTHORIZED
        :status 403: INVALID_SENDER
        :status 422: UNPROCESSABLE_ENTITY
        """
        audit_logs = get_audit_log_records(account)
        audit_logs = [
            {k: getattr(log, k) for k in ("event", "event_datetime", "active_user_id")}
            for log in audit_logs
        ]
        return audit_logs, 200

1	from __future__ import annotations	8✔
2
3	from flask_classful import FlaskView, route	8✔
4	from flexmeasures.data import db	8✔
5	from webargs.flaskparser import use_kwargs, use_args	8✔
6	from flask_security import current_user, auth_required	8✔
7	from flask_json import as_json	8✔
8
9	from flexmeasures.auth.policy import user_has_admin_access	8✔
10	from flexmeasures.auth.decorators import permission_required_for_context	8✔
11	from flexmeasures.data.models.audit_log import AuditLog	8✔
12	from flexmeasures.data.models.user import Account	8✔
13	from flexmeasures.data.services.accounts import get_accounts, get_audit_log_records	8✔
14	from flexmeasures.api.common.schemas.users import AccountIdField	8✔
15	from flexmeasures.data.schemas.account import AccountSchema	8✔
16	from flexmeasures.utils.time_utils import server_now	8✔
17
18	"""	4✔
19	API endpoints to manage accounts.
20
21	Both POST (to create) and DELETE are not accessible via the API, but as CLI functions.
22	Editing (PATCH) is also not yet implemented, but might be next, e.g. for the name or roles.
23	"""
24
25	# Instantiate schemas outside of endpoint logic to minimize response time
26	account_schema = AccountSchema()	8✔
27	accounts_schema = AccountSchema(many=True)	8✔
28	partial_account_schema = AccountSchema(partial=True)	8✔
29
30
31	class AccountAPI(FlaskView):	8✔
32	route_base = "/accounts"	8✔
33	trailing_slash = False	8✔
34	decorators = [auth_required()]	8✔
35
36	@route("", methods=["GET"])	8✔
37	@as_json	8✔
38	def index(self):	8✔
39	"""API endpoint to list all accounts accessible to the current user.
40
41	.. :quickref: Account; Download account list
42
43	This endpoint returns all accessible accounts.
44	Accessible accounts are your own account and accounts you are a consultant for, or all accounts for admins.
45
46	Example response
47
48	An example of one account being returned:
49
50	.. sourcecode:: json
51
52	[
53	{
54	'id': 1,
55	'name': 'Test Account'
56	'account_roles': [1, 3],
57	'consultancy_account_id': 2,
58	}
59	]
60
61	:reqheader Authorization: The authentication token
62	:reqheader Content-Type: application/json
63	:resheader Content-Type: application/json
64	:status 200: PROCESSED
65	:status 400: INVALID_REQUEST
66	:status 401: UNAUTHORIZED
67	:status 403: INVALID_SENDER
68	:status 422: UNPROCESSABLE_ENTITY
69	"""
70	if user_has_admin_access(current_user, "read"):	8✔
71	accounts = get_accounts()	8✔
72	else:
73	accounts = [current_user.account] + (	8✔
74	current_user.account.consultancy_client_accounts
75	if "consultant" in current_user.roles
76	else []
77	)
78
79	return accounts_schema.dump(accounts), 200	8✔
80
81	@route("/<id>", methods=["GET"])	8✔
82	@use_kwargs({"account": AccountIdField(data_key="id")}, location="path")	8✔
83	@permission_required_for_context("read", ctx_arg_name="account")	8✔
84	@as_json	8✔
85	def get(self, id: int, account: Account):	8✔
86	"""API endpoint to get an account.
87
88	.. :quickref: Account; Get an account
89
90	This endpoint retrieves an account, given its id.
91	Only admins, consultants and users belonging to the account itself can use this endpoint.
92
93	Example response
94
95	.. sourcecode:: json
96
97	{
98	'id': 1,
99	'name': 'Test Account'
100	'account_roles': [1, 3],
101	'consultancy_account_id': 2,
102	}
103
104	:reqheader Authorization: The authentication token
105	:reqheader Content-Type: application/json
106	:resheader Content-Type: application/json
107	:status 200: PROCESSED
108	:status 400: INVALID_REQUEST, REQUIRED_INFO_MISSING, UNEXPECTED_PARAMS
109	:status 401: UNAUTHORIZED
110	:status 403: INVALID_SENDER
111	:status 422: UNPROCESSABLE_ENTITY
112	"""
113
114	return account_schema.dump(account), 200	8✔
115
116	@route("/<id>", methods=["PATCH"])	8✔
117	@use_args(partial_account_schema)	8✔
118	@use_kwargs({"account": AccountIdField(data_key="id")}, location="path")	8✔
119	@permission_required_for_context("update", ctx_arg_name="account")	8✔
120	@as_json	8✔
121	def patch(self, account_data: dict, id: int, account: Account):	8✔
122	"""Update an account given its identifier.
123
124	.. :quickref: Account; Update an account
125
126	This endpoint sets data for an existing account.
127
128	The following fields are not allowed to be updated:
129	- id
130
131	The following fields are only editable if user role is admin:
132	- consultancy_account_id
133
134	Example request
135
136	.. sourcecode:: json
137
138	{
139	'name': 'Test Account'
140	'primary_color': '#1a3443'
141	'secondary_color': '#f1a122'
142	'logo_url': 'https://example.com/logo.png'
143	'consultancy_account_id': 2,
144	}
145
146
147	Example response
148
149	The whole account is returned in the response:
150
151	.. sourcecode:: json
152
153	{
154	'id': 1,
155	'name': 'Test Account'
156	'account_roles': [1, 3],
157	'primary_color': '#1a3443'
158	'secondary_color': '#f1a122'
159	'logo_url': 'https://example.com/logo.png'
160	'consultancy_account_id': 2,
161	}
162
163	:reqheader Authorization: The authentication token
164	:reqheader Content-Type: application/json
165	:resheader Content-Type: application/json
166	:status 200: UPDATED
167	:status 400: INVALID_REQUEST, REQUIRED_INFO_MISSING, UNEXPECTED_PARAMS
168	:status 401: UNAUTHORIZED
169	:status 403: INVALID_SENDER
170	:status 422: UNPROCESSABLE_ENTITY
171	"""
172
173	# Get existing consultancy_account_id
NEW 174	existing_consultancy_account_id = (	×
175	account.consultancy_account.id if account.consultancy_account else None
176	)
177
NEW 178	if not user_has_admin_access(current_user, "update"):	×
179	# Remove consultancy_account_id from account_data if no admin access
NEW 180	account_data.pop("consultancy_account_id", None)	×
181	else:
182	# Check if consultancy_account_id has changed
NEW 183	new_consultancy_account_id = account_data.get("consultancy_account_id")	×
NEW 184	if existing_consultancy_account_id != new_consultancy_account_id:	×
NEW 185	new_consultant_account = db.session.query(Account).get(	×
186	new_consultancy_account_id
187	)
188	# Validate new consultant account
NEW 189	if (	×
190	not new_consultant_account
191	or new_consultant_account.id == account.id
192	):
NEW 193	return {"errors": ["Invalid consultancy_account_id"]}, 422	×
194
195	# Track modified fields
NEW 196	fields_to_check = [	×
197	"name",
198	"primary_color",
199	"secondary_color",
200	"logo_url",
201	"consultancy_account_id",
202	]
203
204	# Compile modified fields string
NEW 205	modified_fields_str = ", ".join(	×
206	field
207	for field in fields_to_check
208	if account_data.get(field) != getattr(account, field)
209	)
210
NEW 211	for k, v in account_data.items():	×
NEW 212	setattr(account, k, v)	×
213
NEW 214	event_message = f"Account {account.name} has been updated. Modified fields: {modified_fields_str}"	×
215
216	# Add Audit log
NEW 217	account_audit_log = AuditLog(	×
218	event_datetime=server_now(),
219	event=event_message,
220	active_user_id=current_user.id,
221	active_user_name=current_user.username,
222	affected_user_id=current_user.id,
223	affected_account_id=account.id,
224	)
NEW 225	db.session.add(account_audit_log)	×
NEW 226	db.session.commit()	×
NEW 227	return account_schema.dump(account), 200	×
228
229	@route("/<id>/auditlog", methods=["GET"])	8✔
230	@use_kwargs({"account": AccountIdField(data_key="id")}, location="path")	8✔
231	@permission_required_for_context(	8✔
232	"read",
233	ctx_arg_name="account",
234	pass_ctx_to_loader=True,
235	ctx_loader=AuditLog.account_table_acl,
236	)
237	@as_json	8✔
238	def auditlog(self, id: int, account: Account):	8✔
239	"""API endpoint to get history of account actions.
240	Example response
241
242	.. sourcecode:: json
243	[
244	{
245	'event': 'User test user deleted',
246	'event_datetime': '2021-01-01T00:00:00',
247	'active_user_id': 1,
248	}
249	]
250
251	:reqheader Authorization: The authentication token
252	:reqheader Content-Type: application/json
253	:resheader Content-Type: application/json
254	:status 200: PROCESSED
255	:status 400: INVALID_REQUEST, REQUIRED_INFO_MISSING, UNEXPECTED_PARAMS
256	:status 401: UNAUTHORIZED
257	:status 403: INVALID_SENDER
258	:status 422: UNPROCESSABLE_ENTITY
259	"""
260	audit_logs = get_audit_log_records(account)	8✔
261	audit_logs = [	8✔
262	{k: getattr(log, k) for k in ("event", "event_datetime", "active_user_id")}
263	for log in audit_logs
264	]
265	return audit_logs, 200	8✔

FlexMeasures / flexmeasures / 10773533149

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous