Merge pull request #745 from maykinmedia/fix/663-administrator-unassigns-co-reviewers

[#663] Administrator unassigns co reviewers

Author: SilviaAmAm

backend/src/openarchiefbeheer/destruction/api/permissions.py

@@ -157,15 +157,15 @@ def has_permission(self, request, view):
         ) or request.user.has_perm("accounts.can_start_destruction")
 
     def has_object_permission(self, request, view, destruction_list):
-        if request.user.has_perm("accounts.can_review_destruction"):
-            return destruction_list.status == ListStatus.ready_to_review
-
         if request.user.has_perm("accounts.can_start_destruction"):
             return destruction_list.status in [
                 ListStatus.ready_to_review,
                 ListStatus.new,
             ]
 
+        if request.user.has_perm("accounts.can_review_destruction"):
+            return destruction_list.status == ListStatus.ready_to_review
+
         return False
 
 

backend/src/openarchiefbeheer/destruction/tests/endpoints/test_co_reviewers.py

@@ -470,3 +470,55 @@ def test_record_manager_assigns_themselves_to_new_list(self):
 
         self.assertEqual(1, len(coreviewers))
         self.assertEqual(coreviewers[0].user.pk, administrator.pk)
+
+    @tag("gh-663")
+    def test_record_manager_changes_coreviewers_list(self):
+        author = UserFactory.create(
+            username="record_manager",
+            post__can_start_destruction=True,
+        )
+        reviewer = UserFactory.create(
+            username="reviewer",
+            post__can_review_destruction=True,
+        )
+        administrator = UserFactory.create(
+            username="administrator",
+            post__can_start_destruction=True,
+            post__can_co_review_destruction=True,
+            post__can_review_destruction=True,
+        )
+        destruction_list = DestructionListFactory.create(
+            status=ListStatus.new,
+            name="Test assignement to new list",
+            author=author,
+            assignee=reviewer,
+        )
+        DestructionListAssigneeFactory.create(
+            role=ListRole.author,
+            user=author,
+            destruction_list=destruction_list,
+        )
+        DestructionListAssigneeFactory.create(
+            role=ListRole.main_reviewer,
+            destruction_list=destruction_list,
+            user=reviewer,
+        )
+
+        self.client.force_authenticate(user=administrator)
+        response = self.client.put(
+            reverse(
+                "api:co-reviewers-list",
+                kwargs={"destruction_list_uuid": destruction_list.uuid},
+            ),
+            data={
+                "comment": "test",
+                "add": [],
+            },
+            format="json",
+        )
+
+        self.assertEqual(response.status_code, status.HTTP_200_OK)
+
+        coreviewers = destruction_list.assignees.filter(role=ListRole.co_reviewer)
+
+        self.assertEqual(0, len(coreviewers))