Task Relations (#103)

pkg/models/task_relation_rights.go

@@ -0,0 +1,50 @@
+// Copyright 2019 Vikunja and contriubtors. All rights reserved.
+//
+// This file is part of Vikunja.
+//
+// Vikunja is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// Vikunja is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU General Public License
+// along with Vikunja.  If not, see <https://www.gnu.org/licenses/>.
+
+package models
+
+import "code.vikunja.io/web"
+
+// CanDelete checks if a user can delete a task relation
+func (rel *TaskRelation) CanDelete(a web.Auth) (bool, error) {
+	// A user can delete a relation if it can update the base task
+	baseTask := &Task{ID: rel.TaskID}
+	return baseTask.CanUpdate(a)
+}
+
+// CanCreate checks if a user can create a new relation between two relations
+func (rel *TaskRelation) CanCreate(a web.Auth) (bool, error) {
+	// Check if the relation kind is valid
+	if !rel.RelationKind.isValid() {
+		return false, ErrInvalidRelationKind{Kind: rel.RelationKind}
+	}
+
+	// Needs have write access to the base task and at least read access to the other task
+	baseTask := &Task{ID: rel.TaskID}
+	has, err := baseTask.CanUpdate(a)
+	if err != nil || !has {
+		return false, err
+	}
+
+	// We explicitly don't check if the two tasks are on the same list.
+	otherTask := &Task{ID: rel.OtherTaskID}
+	has, err = otherTask.CanRead(a)
+	if err != nil {
+		return false, err
+	}
+	return has, nil
+}