From e75665695a4fc1465136427424e86fe367cacffa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Josef=20Kol=C3=A1=C5=99?= <josef.kolar@firma.seznam.cz>
Date: Fri, 10 Nov 2023 22:32:13 +0100
Subject: [PATCH] fix(buddy-system): picture permissions, displayed interests

---
 .../parts/request_match_card.html             |  4 +---
 fiesta/apps/buddy_system/views/matching.py    | 22 +++++++++++--------
 2 files changed, 14 insertions(+), 12 deletions(-)

diff --git a/fiesta/apps/buddy_system/templates/buddy_system/parts/request_match_card.html b/fiesta/apps/buddy_system/templates/buddy_system/parts/request_match_card.html
index 6af1c4ab..f897aeac 100644
--- a/fiesta/apps/buddy_system/templates/buddy_system/parts/request_match_card.html
+++ b/fiesta/apps/buddy_system/templates/buddy_system/parts/request_match_card.html
@@ -39,9 +39,7 @@ <h2 class="card-title flex flex-row justify-between">
       </div>
       <div class="chat-bubble">{{ br.note }}</div>
       <div class="chat-bubble border-0 bg-transparent pl-0 pt-0 mt-2 text-base-content">
-        {% for interest in br.issuer.profile.get_interests_display %}
-          <span class="mr-2 badge badge-outline">{{ interest }}</span>
-        {% endfor %}
+        {% for interest in br.get_interests_display %}<span class="mr-2 badge badge-outline">{{ interest }}</span>{% endfor %}
       </div>
     </div>
 
diff --git a/fiesta/apps/buddy_system/views/matching.py b/fiesta/apps/buddy_system/views/matching.py
index d538d7e0..0f3aa8cd 100644
--- a/fiesta/apps/buddy_system/views/matching.py
+++ b/fiesta/apps/buddy_system/views/matching.py
@@ -84,20 +84,24 @@ class IssuerPictureServeView(
     NamespacedFilesServeView,
 ):
     def has_permission(self, request: HttpRequest, name: str) -> bool:
-        # is the file in requests, for whose is the related section responsible?
+        # picture is from requests placed on my section
         related_requests = request.membership.section.buddy_system_requests.filter(
             issuer__profile__picture=name,
         )
 
-        # does have the section enabled picture displaying?
-        return (related_requests.exists() and self.configuration and self.configuration.display_issuer_picture) or (
-            related_requests.filter(
-                state=BuddyRequest.State.MATCHED,
-            )
-            .filter(
-                Q(match__matcher=request.user) | Q(issuer=request.user),
+        return (
+            # does have the section enabled picture displaying?
+            (related_requests.exists() and self.configuration and self.configuration.display_issuer_picture)
+            # or are we in a matched request?
+            or (
+                related_requests.filter(
+                    state=BuddyRequest.State.MATCHED,
+                )
+                .filter(match__matcher=request.user)
+                .exists()
             )
-            .exists()
+            # or am I the issuer?
+            or (related_requests.filter(issuer=request.user).exists())
         )