From 0e8a97acb03baf2615f66d6bc8f3b40f0174ae14 Mon Sep 17 00:00:00 2001
From: Matthias <matmair@live.de>
Date: Mon, 7 Jun 2021 05:23:13 +0200
Subject: [PATCH] added permissions

---
 InvenTree/part/api.py                              |  1 +
 InvenTree/part/templates/part/internal_prices.html | 12 ++++++++++--
 InvenTree/part/templates/part/navbar.html          |  2 +-
 InvenTree/part/templates/part/order_prices.html    |  3 +++
 InvenTree/part/templates/part/part_pricing.html    |  5 +++++
 InvenTree/part/views.py                            |  3 +++
 6 files changed, 23 insertions(+), 3 deletions(-)

diff --git a/InvenTree/part/api.py b/InvenTree/part/api.py
index 8883699f9a..c2785b666f 100644
--- a/InvenTree/part/api.py
+++ b/InvenTree/part/api.py
@@ -201,6 +201,7 @@ class PartInternalPriceList(generics.ListCreateAPIView):
 
     queryset = PartInternalPriceBreak.objects.all()
     serializer_class = part_serializers.PartInternalPriceSerializer
+    permission_required = 'roles.sales_order.show'
 
     filter_backends = [
         DjangoFilterBackend
diff --git a/InvenTree/part/templates/part/internal_prices.html b/InvenTree/part/templates/part/internal_prices.html
index fdc69ce198..2f54f3bb64 100644
--- a/InvenTree/part/templates/part/internal_prices.html
+++ b/InvenTree/part/templates/part/internal_prices.html
@@ -13,7 +13,7 @@
 
 {% block details %}
 {% settings_value "PART_INTERNAL_PRICE" as show_internal_price %}
-{% if show_internal_price %}
+{% if show_internal_price and roles.sales_order.view %}
 <div id='internal-price-break-toolbar' class='btn-group'>
     <button class='btn btn-primary' id='new-internal-price-break' type='button'>
         <span class='fas fa-plus-circle'></span> {% trans "Add Internal Price Break" %}
@@ -23,6 +23,14 @@
 <table class='table table-striped table-condensed' id='internal-price-break-table' data-toolbar='#internal-price-break-toolbar'>
 </table>
 
+{% else %}
+<div class='container-fluid'>
+    <h3>{% trans "Permission Denied" %}</h3>
+
+    <div class='alert alert-danger alert-block'>
+        {% trans "You do not have permission to view this page." %}
+    </div>
+</div>
 {% endif %}
 {% endblock %}
 
@@ -30,7 +38,7 @@
 {{ block.super }}
 
 {% settings_value "PART_INTERNAL_PRICE" as show_internal_price %}
-{% if show_internal_price %}
+{% if show_internal_price and roles.sales_order.view %}
 function reloadPriceBreaks() {
     $("#internal-price-break-table").bootstrapTable("refresh");
 }
diff --git a/InvenTree/part/templates/part/navbar.html b/InvenTree/part/templates/part/navbar.html
index 1e5c5a74de..c0bc4c96a3 100644
--- a/InvenTree/part/templates/part/navbar.html
+++ b/InvenTree/part/templates/part/navbar.html
@@ -96,7 +96,7 @@
         </a>
     </li>
     {% endif %}
-    {% if show_internal_price %}
+    {% if show_internal_price and roles.sales_order.view %}
     <li class='list-group-item {% if tab == "internal-prices" %}active{% endif %}' title='{% trans "Internal Price Information" %}'>
         <a href='{% url "part-internal-prices" part.id %}'>
             <span class='menu-tab-icon fas fa-dollar-sign' style='width: 20px;'></span>
diff --git a/InvenTree/part/templates/part/order_prices.html b/InvenTree/part/templates/part/order_prices.html
index 3633e9095c..e8587a348d 100644
--- a/InvenTree/part/templates/part/order_prices.html
+++ b/InvenTree/part/templates/part/order_prices.html
@@ -14,6 +14,7 @@
 
 {% block details %}
 {% default_currency as currency %}
+{% settings_value "PART_INTERNAL_PRICE" as show_internal_price %}
 
 {% crispy form %}
 
@@ -77,6 +78,7 @@
     {% endif %}
 {% endif %}
 
+{% if show_internal_price and roles.sales_order.view %}
 {% if total_internal_part_price %}
     <tr>
         <td><b>{% trans 'Internal Price' %}</b></td>
@@ -89,6 +91,7 @@
         <td colspan='2'>{% include "price.html" with price=total_internal_part_price %}</td>
     </tr>
 {% endif %}
+{% endif %}
 
 {% if total_part_price %}
     <tr>
diff --git a/InvenTree/part/templates/part/part_pricing.html b/InvenTree/part/templates/part/part_pricing.html
index cd5db9619c..ce55124bd9 100644
--- a/InvenTree/part/templates/part/part_pricing.html
+++ b/InvenTree/part/templates/part/part_pricing.html
@@ -3,7 +3,10 @@
 {% load i18n inventree_extras %}
 
 {% block pre_form_content %}
+
 {% default_currency as currency %}
+{% settings_value "PART_INTERNAL_PRICE" as show_internal_price %}
+
 <table class='table table-striped table-condensed table-price-two'>
     <tr>
         <td><b>{% trans 'Part' %}</b></td>
@@ -74,6 +77,7 @@
     </table>
 {% endif %}
 
+{% if show_internal_price and roles.sales_order.view %}
 {% if total_internal_part_price %}
     <h4>{% trans 'Internal Price' %}</h4>
     <table class='table table-striped table-condensed table-price-two'>
@@ -87,6 +91,7 @@
         </tr>
     </table>
 {% endif %}
+{% endif %}
 
 {% if total_part_price %}
     <h4>{% trans 'Sale Price' %}</h4>
diff --git a/InvenTree/part/views.py b/InvenTree/part/views.py
index ee7733a6be..2459dcaa32 100644
--- a/InvenTree/part/views.py
+++ b/InvenTree/part/views.py
@@ -2808,6 +2808,7 @@ class PartInternalPriceBreakCreate(PartSalePriceBreakCreate):
     model = PartInternalPriceBreak
     form_class = part_forms.EditPartInternalPriceBreakForm
     ajax_form_title = _('Add Internal Price Break')
+    permission_required = 'roles.sales_order.add'
 
 
 class PartInternalPriceBreakEdit(PartSalePriceBreakEdit):
@@ -2816,6 +2817,7 @@ class PartInternalPriceBreakEdit(PartSalePriceBreakEdit):
     model = PartInternalPriceBreak
     form_class = part_forms.EditPartInternalPriceBreakForm
     ajax_form_title = _('Edit Internal Price Break')
+    permission_required = 'roles.sales_order.change'
 
 
 class PartInternalPriceBreakDelete(PartSalePriceBreakDelete):
@@ -2823,3 +2825,4 @@ class PartInternalPriceBreakDelete(PartSalePriceBreakDelete):
 
     model = PartInternalPriceBreak
     ajax_form_title = _("Delete Internal Price Break")
+    permission_required = 'roles.sales_order.delete'