Implemented Create and Update methods on list

models/crudable.go

@@ -1,9 +1,9 @@
 package models
 
 type CRUDable interface {
-	Create()
+	Create(*User) (error)
 	ReadOne(int64) error
 	ReadAll(*User) (interface{}, error)
-	Update()
+	Update(int64, *User) error
 	Delete()
 }

models/error.go

@@ -143,19 +143,19 @@ func (err ErrListDoesNotExist) Error() string {
 	return fmt.Sprintf("List does not exist [ID: %d]", err.ID)
 }
 
-// ErrNeedToBeListOwner represents an error, where the user is not the owner of that list (used i.e. when deleting a list)
-type ErrNeedToBeListOwner struct {
+// ErrNeedToBeListAdmin represents an error, where the user is not the owner of that list (used i.e. when deleting a list)
+type ErrNeedToBeListAdmin struct {
 	ListID int64
 	UserID int64
 }
 
 // IsErrListDoesNotExist checks if an error is a ErrListDoesNotExist.
-func IsErrNeedToBeListOwner(err error) bool {
-	_, ok := err.(ErrNeedToBeListOwner)
+func IsErrNeedToBeListAdmin(err error) bool {
+	_, ok := err.(ErrNeedToBeListAdmin)
 	return ok
 }
 
-func (err ErrNeedToBeListOwner) Error() string {
+func (err ErrNeedToBeListAdmin) Error() string {
 	return fmt.Sprintf("You need to be list owner to do that [ListID: %d, UserID: %d]", err.ListID, err.UserID)
 }
 
@@ -289,3 +289,4 @@ func IsErrUserDoesNotHaveWriteAccessToNamespace(err error) bool {
 func (err ErrUserDoesNotHaveWriteAccessToNamespace) Error() string {
 	return fmt.Sprintf("You need to have write access to this namespace to do that [NamespaceID: %d, UserID: %d]", err.NamespaceID, err.UserID)
 }
+

models/list_create_update.go

@@ -2,18 +2,6 @@ package models
 
 // CreateOrUpdateList updates a list or creates it if it doesn't exist
 func CreateOrUpdateList(list *List) (err error) {
-	// Check if it exists
-	_, err = GetListByID(list.ID)
-	if err != nil {
-		return
-	}
-
-	// Check if the user exists
-	list.Owner, _, err = GetUserByID(list.Owner.ID)
-	if err != nil {
-		return
-	}
-	list.OwnerID = list.Owner.ID
 
 	if list.ID == 0 {
 		_, err = x.Insert(list)
@@ -30,3 +18,46 @@ func CreateOrUpdateList(list *List) (err error) {
 	return
 
 }
+
+func (l *List) Update(id int64, doer *User) (err error)  {
+	l.ID = id
+
+	// Check if it exists
+	oldList, err := GetListByID(l.ID)
+	if err != nil {
+		return
+	}
+
+	// Check rights
+	user, _, err := GetUserByID(doer.ID)
+	if err != nil {
+		return
+	}
+
+	if !oldList.IsAdmin(&user) {
+		return ErrNeedToBeListAdmin{ListID:id, UserID:user.ID}
+	}
+
+	return CreateOrUpdateList(l)
+}
+
+func (l *List) Create(doer *User) (err error) {
+	// Check rights
+	user, _, err := GetUserByID(doer.ID)
+	if err != nil {
+		return
+	}
+
+	// Get the namespace of the list to check if the user can write to it
+	namespace, err := GetNamespaceByID(l.NamespaceID)
+	if err != nil {
+		return
+	}
+	if !namespace.CanWrite(doer) {
+		return ErrUserDoesNotHaveWriteAccessToNamespace{UserID:user.ID, NamespaceID:namespace.ID}
+	}
+
+	l.Owner.ID = user.ID
+
+	return CreateOrUpdateList(l)
+}

models/list_delete.go

@@ -9,7 +9,7 @@ func DeleteListByID(listID int64, doer *User) (err error) {
 	}
 
 	if list.Owner.ID != doer.ID {
-		return ErrNeedToBeListOwner{ListID: listID, UserID: doer.ID}
+		return ErrNeedToBeListAdmin{ListID: listID, UserID: doer.ID}
 	}
 
 	// Delete the list

models/list_items_create_update.go

@@ -16,8 +16,6 @@ func CreateOrUpdateListItem(item *ListItem) (newItem *ListItem, err error) {
 	}
 	item.CreatedByID = item.CreatedBy.ID
 
-	// TODO: Check if the user has the right to add/update an item to that list
-
 	if item.ID != 0 {
 		_, err = x.ID(item.ID).Update(item)
 		if err != nil {

models/lists.go

@@ -15,6 +15,7 @@ type List struct {
 	Updated int64 `xorm:"updated" json:"updated"`
 
 	CRUDable `xorm:"-" json:"-"`
+	Rights `xorm:"-" json:"-"`
 }
 
 // Lists is a multiple of list
@@ -73,3 +74,19 @@ func (l *List) ReadOne(id int64) (err error) {
 	*l, err = GetListByID(id)
 	return
 }
+
+func (l *List) IsAdmin(user *User) bool {
+	// Owners are always admins
+	if l.Owner.ID == user.ID {
+		return true
+	}
+
+	// Check Team rights
+	// aka "is the user in a team which has admin rights?"
+	// TODO
+
+	// Check Namespace rights
+	// TODO
+
+	return false
+}

models/namespaces.go

@@ -11,6 +11,9 @@ type Namespace struct {
 
 	Created int64 `xorm:"created" json:"created"`
 	Updated int64 `xorm:"updated" json:"updated"`
+
+	CRUDable `xorm:"-" json:"-"`
+	Rights `xorm:"-" json:"-"`
 }
 
 // TableName makes beautiful table names
@@ -58,6 +61,14 @@ func (user *User) HasNamespaceAccess(namespace *Namespace) (err error) {
 	return ErrUserDoesNotHaveAccessToNamespace{UserID: user.ID, NamespaceID: namespace.ID}
 }
 
+func (n *Namespace) CanWrite(user *User) bool {
+	if err := user.HasNamespaceAccess(n); err != nil {
+		return false
+	}
+
+	return true
+}
+
 func (user *User) HasNamespaceWriteAccess(namespace *Namespace) (err error) {
 
 	// Owners always have access

models/rights.go

@@ -2,4 +2,6 @@ package models
 
 type Rights interface {
 	IsAdmin(*User) bool
+	CanWrite(*User) bool
+	CanRead(*User) bool
 }