Merge branch '271-pizza-cancellation' into 'master'

Make  sure that members cannot cancel or change pizza order when not allowed

Closes #271

See merge request !295

website/pizzas/models.py

@@ -21,10 +21,14 @@ class PizzaEvent(models.Model):
     def in_the_future(self):
         return self.start > timezone.now()
 
+    @property
+    def has_ended(self):
+        return self.end < timezone.now()
+
     @property
     def just_ended(self):
-        return (self.end < timezone.now()
-                and self.end + timezone.timedelta(hours=8) > timezone.now())
+        return (self.has_ended and
+                self.end + timezone.timedelta(hours=8) > timezone.now())
 
     @classmethod
     def current(cls):
@@ -91,5 +95,9 @@ class Order(models.Model):
             return self.member.get_full_name()
         return self.name
 
+    @property
+    def can_be_changed(self):
+        return not self.paid and not self.pizza_event.has_ended
+
     class Meta:
         unique_together = ('pizza_event', 'member')

website/pizzas/templates/pizzas/index.html

@@ -81,7 +81,7 @@
                         <td>{{ order.product.description }}</td>
                         <td>&euro; {{ order.product.price }}</td>
                         <td>
-                            {% if event.just_ended %}
+                            {% if not order.can_be_changed %}
                                 {% trans "You can no longer cancel." %}
                             {% else %}
                                 <form class="form-horizontal pizza-order-form" method="post" action="{% url 'pizzas:cancel-order' %}">
@@ -100,31 +100,33 @@
         {% elif event.just_ended %}
             {% trans "You did not place an order." %}
         {% endif %}
-        {% if not event.just_ended %}
-            <div style="overflow-x: auto;">
-                <table class="category table table-striped table-bordered table-hover">
-                    <tr>
-                        <th>{% trans "Name" %}</th>
-                        <th>{% trans "Description" %}</th>
-                        <th>{% trans "Price" %}</th>
-                        <th>{% if order %}{% trans "Modify" %}{% else %}{% trans "Order" context "pizzas" %}{% endif %}</th>
-                    </tr>
-                    {% for product in products %}
+        {% if not event.has_ended %}
+            {% if order == None or order.can_be_changed %}
+                <div style="overflow-x: auto;">
+                    <table class="category table table-striped table-bordered table-hover">
                         <tr>
-                            <td>{{ product.name }}</td>
-                            <td>{{ product.description }}</td>
-                            <td>&euro; {{ product.price }}</td>
-                            <td>
-                                <form class="form-horizontal pizza-order-form" method="post" action="{% url 'pizzas:order' %}">
-                                    {% csrf_token %}
-                                    <input type="hidden" name="product" value="{{ product.pk }}" />
-                                    <input type="submit" class="btn btn-style1" {% if order %}value='{% trans "Modify" %}' onclick="return confirm('{% trans "Are you sure you want to modify your order?" %}')"{% else %}value='{% trans "Order" context "pizzas" %}'{% endif %} />
-                                </form>
-                            </td>
+                            <th>{% trans "Name" %}</th>
+                            <th>{% trans "Description" %}</th>
+                            <th>{% trans "Price" %}</th>
+                            <th>{% if order %}{% trans "Modify" %}{% else %}{% trans "Order" context "pizzas" %}{% endif %}</th>
                         </tr>
-                    {% endfor %}
-                </table>
-            </div>
+                        {% for product in products %}
+                            <tr>
+                                <td>{{ product.name }}</td>
+                                <td>{{ product.description }}</td>
+                                <td>&euro; {{ product.price }}</td>
+                                <td>
+                                    <form class="form-horizontal pizza-order-form" method="post" action="{% url 'pizzas:order' %}">
+                                        {% csrf_token %}
+                                        <input type="hidden" name="product" value="{{ product.pk }}" />
+                                        <input type="submit" class="btn btn-style1" {% if order %}value='{% trans "Modify" %}' onclick="return confirm('{% trans "Are you sure you want to modify your order?" %}')"{% else %}value='{% trans "Order" context "pizzas" %}'{% endif %} />
+                                    </form>
+                                </td>
+                            </tr>
+                        {% endfor %}
+                    </table>
+                </div>
+            {% endif %}
         {% endif %}
     {% endif %}
 {% endif %}

website/pizzas/views.py

@@ -99,7 +99,10 @@ def cancel_order(request):
     if 'order' in request.POST:
         try:
             order = get_object_or_404(Order, pk=int(request.POST['order']))
-            if order.member == request.user.member:
+            if not order.can_be_changed:
+                messages.error(request,
+                               _('You can no longer cancel.'))
+            elif order.member == request.user.member:
                 order.delete()
                 messages.success(request, _("Your order has been cancelled."))
         except Http404:
@@ -126,10 +129,20 @@ def add_order(request, event_pk):
 
 @login_required
 def order(request):
-    if 'product' in request.POST:
+    event = PizzaEvent.current()
+    if not event:
+        return HttpResponseRedirect(reverse('pizzas:index'))
+
+    try:
+        order_placed = Order.objects.get(pizza_event=event,
+                                         member=request.user.member)
+        current_order_locked = not order_placed.can_be_changed
+    except Order.DoesNotExist:
+        current_order_locked = False
+
+    if 'product' in request.POST and not current_order_locked:
         product = Product.objects.get(pk=int(request.POST['product']))
         if product:
-            event = PizzaEvent.current()
             try:
                 order = Order.objects.get(pizza_event=event,
                                           member=request.user.member)