fix: speakers can't be edited after the cfs ends

app/api/helpers/speaker.py

@@ -0,0 +1,23 @@
+from app.models.speakers_call import SpeakersCall
+from app.api.helpers.permission_manager import has_access
+from datetime import datetime
+from app.api.helpers.exceptions import ForbiddenException
+
+
+def can_edit_after_cfs_ends(event_id):
+    """
+    Method to check that user has permission to edit the speaker or session
+    after the CFS ends
+    """
+    speakers_call = SpeakersCall.query.filter_by(event_id=event_id).one()
+    if speakers_call:
+        speakers_call_tz = speakers_call.ends_at.tzinfo
+        if speakers_call.ends_at <= datetime.now().replace(tzinfo=speakers_call_tz) \
+            and not (has_access('is_admin') or has_access('is_organizer', event_id=event_id) or
+                     has_access('is_coorganizer', event_id=event_id)):
+            return False
+        else:
+            return True
+    else:
+        raise ForbiddenException({'source': '/data/event-id'},
+                                 'Speaker Calls for event {id} not found'.format(id=event_id))

app/api/sessions.py

@@ -9,6 +9,7 @@
 from app.api.helpers.notification import send_notif_new_session_organizer, send_notif_session_accept_reject
 from app.api.helpers.permission_manager import has_access
 from app.api.helpers.query import event_query
+from app.api.helpers.speaker import can_edit_after_cfs_ends
 from app.api.helpers.utilities import require_relationship
 from app.api.schema.sessions import SessionSchema
 from app.models import db
@@ -17,8 +18,6 @@
 from app.models.session_type import SessionType
 from app.models.speaker import Speaker
 from app.models.track import Track
-from app.models.speakers_call import SpeakersCall
-from datetime import datetime
 from app.models.user import User
 from app.models.session_speaker_link import SessionsSpeakersLink
 from app.settings import get_settings
@@ -150,11 +149,7 @@ def before_update_object(self, session, data, view_kwargs):
         if session.is_locked and data.get('is_locked') == session.is_locked:
             raise ForbiddenException({'source': '/data/attributes/is-locked'}, "Locked sessions cannot be edited")
 
-        speakers_call = safe_query(self, SpeakersCall, 'event_id', session.event_id, 'event-id')
-        speakers_call_tz = speakers_call.ends_at.tzinfo
-        if speakers_call.ends_at <= datetime.now().replace(tzinfo=speakers_call_tz) and \
-           not (has_access('is_admin') or has_access('is_organizer', event_id=session.event_id) or
-                has_access('is_coorganizer', event_id=session.event_id)):
+        if not can_edit_after_cfs_ends(session.event_id):
             raise ForbiddenException({'source': ''},
                                      "Cannot edit session after the call for speaker is ended")
 

app/api/speakers.py

@@ -9,6 +9,7 @@
 from app.api.helpers.permission_manager import has_access
 from app.api.helpers.query import event_query
 from app.api.helpers.utilities import require_relationship
+from app.api.helpers.speaker import can_edit_after_cfs_ends
 from app.api.schema.speakers import SpeakerSchema
 from app.models import db
 from app.models.event import Event
@@ -132,6 +133,10 @@ def before_update_object(self, speaker, data, view_kwargs):
         :param view_kwargs:
         :return:
         """
+        if not can_edit_after_cfs_ends(speaker.event_id):
+            raise ForbiddenException({'source': ''},
+                                     "Cannot edit speaker after the call for speaker is ended")
+
         if data.get('photo_url') and data['photo_url'] != speaker.photo_url:
             start_image_resizing_tasks(speaker, data['photo_url'])
 

tests/hook_main.py

@@ -1269,6 +1269,8 @@ def speaker_patch(transaction):
     """
     with stash['app'].app_context():
         speaker = SpeakerFactory()
+        speakers_call = SpeakersCallFactory()
+        db.session.add(speakers_call)
         db.session.add(speaker)
         db.session.commit()
 
@@ -1282,6 +1284,8 @@ def speaker_delete(transaction):
     """
     with stash['app'].app_context():
         speaker = SpeakerFactory()
+        speakers_call = SpeakersCallFactory()
+        db.session.add(speakers_call)
         db.session.add(speaker)
         db.session.commit()