👌 #448 - feat: don't allow the reviewer to reassign a destruction list

Author: svenvandescheur

backend/src/openarchiefbeheer/destruction/api/permissions.py

@@ -74,9 +74,7 @@ class CanReassignDestructionList(permissions.BasePermission):
     message = _("You are not allowed to reassign the destruction list.")
 
     def has_permission(self, request, view):
-        return request.user.has_perm(
-            "accounts.can_start_destruction"
-        ) or request.user.has_perm("accounts.can_review_destruction")
+        return request.user.has_perm("accounts.can_start_destruction")
 
     def has_object_permission(self, request, view, destruction_list):
         return destruction_list.status in [

backend/src/openarchiefbeheer/destruction/tests/e2e/issues/test_459_update_reviewer.py

@@ -33,27 +33,3 @@ async def test_scenario_record_manager_updates_reviewer(self):
 
             await self.then.page_should_contain_text(page, "Destruction list to update")
             await self.then.list_should_have_assignee(page, destruction_list, reviewer2)
-
-    async def test_scenario_reviewer_updates_reviewer(self):
-        async with browser_page() as page:
-            record_manger = await self.given.record_manager_exists()
-            reviewer1 = await self.given.reviewer_exists(username="reviewer1", first_name="John", last_name="Doe", post__can_start_destruction=True)
-            reviewer2 = await self.given.reviewer_exists(username="reviewer2", first_name="Jane", last_name="Doe")
-
-            await self.given.assignee_exists(user=record_manger)
-            assignee_reviewer1 = await self.given.assignee_exists(user=reviewer1)
-
-            destruction_list = await self.given.list_exists(name="Destruction list to update", assignees=[assignee_reviewer1], assignee=assignee_reviewer1.user, status=ListStatus.ready_to_review)
-
-            await self.when.reviewer_logs_in(page, username="reviewer1")
-            await self.then.path_should_be(page, "/destruction-lists")
-            await self.then.list_should_have_assignee(page, destruction_list, reviewer1)
-
-            await self.when.user_clicks_button(page, "Destruction list to update")
-            await self.when.user_clicks_button(page, "Beoordelaar bewerken")
-            await self.when.user_fills_form_field(page, "Beoordelaar", "Jane Doe (reviewer2)")
-            await self.when.user_fills_form_field(page, "Reden", "gh-459")
-            await self.when.user_clicks_button(page, "Toewijzen")
-
-            await self.then.page_should_contain_text(page, "Destruction list to update")
-            await self.then.list_should_have_assignee(page, destruction_list, reviewer2)

frontend/src/components/DestructionListReviewer/DestructionListReviewer.stories.tsx

@@ -150,7 +150,6 @@ const assertEditCoReviewers: PlayFunction<ReactRenderer> = async (context) => {
     parameters: {
       form: form,
       formValues: {
-        Beoordelaar: "Proces ei Genaar (Proces ei Genaar)",
         "Medebeoordelaar 2": "Co Reviewer (co-reviewer)",
         Reden: "Edit co-reviewers",
       },
@@ -166,7 +165,7 @@ const assertEditCoReviewers: PlayFunction<ReactRenderer> = async (context) => {
       libDestructionList,
       "reassignDestructionList",
     );
-    expect(reassignDestructionList).toHaveBeenCalled();
+    expect(reassignDestructionList).not.toHaveBeenCalled();
 
     const updateCoReviewers = getMock(
       context.parameters,

frontend/src/components/DestructionListReviewer/DestructionListReviewer.tsx

@@ -89,10 +89,9 @@ export function DestructionListReviewer({
       promises.push(promise);
     }
 
-    const reviewerPk = Number(reviewer);
-    if (reviewerPk !== user?.pk) {
+    if (reviewer) {
       const promise = reassignDestructionList(destructionList.uuid, {
-        assignee: { user: reviewerPk },
+        assignee: { user: Number(reviewer) },
         comment: String(comment),
       }).catch(async (e) => {
         console.error(e);
@@ -161,7 +160,7 @@ export function DestructionListReviewer({
           value: assignedCoReviewers[i]?.user.pk,
         }));
 
-      return [reviewer, ...coReviewerFields, comment];
+      return [...coReviewerFields, comment];
     }
     return [reviewer, comment];
   }, [user, destructionList, reviewers, assignedCoReviewers]);