Merge pull request #1633 from IFRCGo/1632-prod-event-visibility-check

Fix visibility check for IFRC and IFRC_NS events

Author: szabozoltan69

api/drf_views.py

@@ -18,6 +18,7 @@
 from deployments.models import Personnel
 from databank.serializers import CountryOverviewSerializer
 
+from .utils import is_user_ifrc
 from .event_sources import SOURCES
 from .exceptions import BadRequest
 from .view_filters import ListFilter
@@ -437,10 +438,20 @@ def retrieve(self, request, pk=None, *args, **kwargs):
         if pk:
             try:
                 if self.request.user.is_authenticated:
-                    if self.request.user.is_superuser:
+                    if is_user_ifrc(self.request.user):
                         instance = Event.objects.get(pk=pk)
                     else:
-                        instance = Event.objects.exclude(visibility=VisibilityChoices.IFRC).exclude(Q(visibility=VisibilityChoices.IFRC_NS) & ~Q(countries__id__in=UserCountry.objects.filter(user=self.request.user.id).values_list('country',flat=True).union(Profile.objects.filter(user=self.request.user.id).values_list('country',flat=True)))).get(pk=pk)
+                        user_countries = UserCountry.objects\
+                            .filter(user=request.user.id).values('country')\
+                            .union(
+                                Profile.objects.filter(user=request.user.id).values('country')
+                            )
+                        instance = Event.objects\
+                            .exclude(
+                                visibility=VisibilityChoices.IFRC)\
+                            .exclude(
+                                Q(visibility=VisibilityChoices.IFRC_NS) & ~Q(countries__id__in=user_countries))\
+                            .get(pk=pk)
                 else:
                     instance = Event.objects.filter(visibility=VisibilityChoices.PUBLIC).get(pk=pk)
                 # instance = Event.get_for(request.user).get(pk=pk)