From f28ad9a12de023963b2ce8c7b4a07f7453261c4a Mon Sep 17 00:00:00 2001
From: Hugo LEVY-FALK <hugo.levy--falk@supelec.fr>
Date: Mon, 16 Jul 2018 20:14:26 +0200
Subject: [PATCH] =?UTF-8?q?V=C3=A9rification=20de=20la=20permission=20de?=
 =?UTF-8?q?=20cr=C3=A9diter=20le=20solde=20coh=C3=A9rente.?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 cotisations/migrations/0030_custom_payment.py |  1 +
 cotisations/payment_methods/balance/models.py | 10 ++++++++++
 cotisations/views.py                          | 20 ++++++++++++++++++-
 users/views.py                                | 13 +++++++++---
 4 files changed, 40 insertions(+), 4 deletions(-)

diff --git a/cotisations/migrations/0030_custom_payment.py b/cotisations/migrations/0030_custom_payment.py
index 6cf74f22..ec6f08d1 100644
--- a/cotisations/migrations/0030_custom_payment.py
+++ b/cotisations/migrations/0030_custom_payment.py
@@ -116,6 +116,7 @@ class Migration(migrations.Migration):
                 ('minimum_balance', models.DecimalField(decimal_places=2, default=0, help_text='The minimal amount of money allowed for the balance at the end of a payment. You can specify negative amount.', max_digits=5, verbose_name='Minimum balance')),
                 ('payment', models.OneToOneField(editable=False, on_delete=django.db.models.deletion.CASCADE, related_name='payment_method', to='cotisations.Paiement')),
                 ('maximum_balance', models.DecimalField(decimal_places=2, default=50, help_text='The maximal amount of money allowed for the balance.', max_digits=5, verbose_name='Maximum balance', null=True, blank=True)),
+                ('credit_balance_allowed', models.BooleanField(default=False, verbose_name='Allow user to credit their balance')),
             ],
             bases=(cotisations.payment_methods.mixins.PaymentMethodMixin, models.Model),
             options={'verbose_name': 'User Balance'},
diff --git a/cotisations/payment_methods/balance/models.py b/cotisations/payment_methods/balance/models.py
index 8c328279..4e488405 100644
--- a/cotisations/payment_methods/balance/models.py
+++ b/cotisations/payment_methods/balance/models.py
@@ -63,6 +63,10 @@ class BalancePayment(PaymentMethodMixin, models.Model):
         blank=True,
         null=True,
     )
+    credit_balance_allowed = models.BooleanField(
+        verbose_name=_l("Allow user to credit their balance"),
+        default=False,
+    )
 
     def end_payment(self, invoice, request):
         """Changes the user's balance to pay the invoice. If it is not
@@ -108,3 +112,9 @@ class BalancePayment(PaymentMethodMixin, models.Model):
             float(user.solde) - float(price) >= self.minimum_balance,
             _("Your balance is too low for this operation.")
         )
+
+    def can_credit_balance(self, user_request):
+        return (
+            len(Paiement.find_allowed_payments(user_request)
+                .exclude(is_balance=True)) > 0
+        ) and self.credit_balance_allowed
diff --git a/cotisations/views.py b/cotisations/views.py
index d015484a..c6403a1f 100644
--- a/cotisations/views.py
+++ b/cotisations/views.py
@@ -699,13 +699,31 @@ def index(request):
 
 # TODO : change solde to balance
 @login_required
-@can_create(Facture)
 @can_edit(User)
 def credit_solde(request, user, **_kwargs):
     """
     View used to edit the balance of a user.
     Can be use either to increase or decrease a user's balance.
     """
+    try:
+        balance = find_payment_method(Paiement.objects.get(is_balance=True))
+    except Paiement.DoesNotExist:
+        credit_allowed = False
+    else:
+        credit_allowed = (
+            balance is not None
+            and balance.can_credit_balance(request.user)
+        )
+    if not credit_allowed:
+        messages.error(
+            request,
+            _("You are not allowed to credit your balance.")
+        )
+        return redirect(reverse(
+            'users:profil',
+            kwargs={'userid': user.id}
+        ))
+
     refill_form = RechargeForm(request.POST or None, user=request.user)
     if refill_form.is_valid():
         price = refill_form.cleaned_data['value']
diff --git a/users/views.py b/users/views.py
index 040b7b3f..0c04a2d9 100644
--- a/users/views.py
+++ b/users/views.py
@@ -67,6 +67,7 @@ from re2o.acl import (
     can_view_all,
     can_change
 )
+from cotisations.utils import find_payment_method
 
 from .serializers import MailingSerializer, MailingMemberSerializer
 from .models import (
@@ -898,9 +899,15 @@ def profil(request, users, **_kwargs):
         request.GET.get('order'),
         SortTable.USERS_INDEX_WHITE
     )
-    balance, _created = Paiement.objects.get_or_create(moyen="solde")
-    user_solde = Facture.can_create(request.user)[0] \
-        and balance.can_use_payment(request.user)[0]
+    try:
+        balance = find_payment_method(Paiement.objects.get(is_balance=True))
+    except Paiement.DoesNotExist:
+        user_solde = False
+    else:
+        user_solde = (
+            balance is not None
+            and balance.can_credit_balance(request.user)
+        )
     return render(
         request,
         'users/profil.html',