fix: feedback permissions

SELab-2 · May 24, 2024 · 15682e9 · 15682e9
1 parent 3bec493
commit 15682e9
Show file tree

Hide file tree

Showing 3 changed files with 12 additions and 5 deletions.
diff --git a/backend/api/permissions/submission_permissions.py b/backend/api/permissions/submission_permissions.py
@@ -1,5 +1,6 @@
 from typing import cast
 
+from api.models.course import Course
 from api.models.submission import (ExtraCheckResult, StructureCheckResult,
                                    Submission)
 from api.permissions.role_permissions import (is_assistant, is_student,
@@ -41,8 +42,14 @@ class SubmissionFeedbackPermission(SubmissionPermission):
     def has_permission(self, request: Request, view: APIView) -> bool:
         return True
 
-    def has_object_permission(self, request: Request, view: APIView, obj: Submission) -> bool:
-        return True
+    def has_object_permission(self, request: Request, view: APIView, submission: Submission) -> bool:
+        if is_student(request.user) and submission.group.students.contains(request.user):
+            return True
+
+        if is_teacher(request.user) or is_assistant(request.user):
+            return True
+
+        return False
 
 
 class StructureCheckResultPermission(SubmissionPermission):

diff --git a/backend/api/views/feedback_view.py b/backend/api/views/feedback_view.py
@@ -6,7 +6,7 @@
 from api.serializers.feedback_serializer import FeedbackSerializer
 
 
-class FeedbackViewSet(viewsets.ModelViewSet):
+class FeedbackViewSet(viewsets.ReadOnlyModelViewSet):
     queryset = Feedback.objects.all()
     serializer_class = FeedbackSerializer
     permission_classes = [IsAdminOrTeacherForPatch]
diff --git a/frontend/src/views/submissions/SubmissionView.vue b/frontend/src/views/submissions/SubmissionView.vue
@@ -116,7 +116,7 @@ watchImmediate(
         <template v-if="submission !== null">
             <div class="fadein grid">
                 <!-- Submission properties -->
-                <div class="col-6 md:col-4">
+                <div class="col-12 md:col-4">
                     <!-- Submission status -->
                     <div class="mb-5">
                         <Title class="flex">Status</Title>
@@ -159,7 +159,7 @@ watchImmediate(
                     </template>
                 </div>
                 <!-- Feedback section -->
-                <div class="col-12 md:col-7">
+                <div class="col-12 md:col-8">
                     <!-- Written Feedback overview -->
                     <div class="feedback-section mb-3">
                         <Title class="flex mb-3">Feedback</Title>