From 8786f4b845cae612a77b29cc468057ef8ac0ab9e Mon Sep 17 00:00:00 2001
From: jedi <git@m.j3d1.de>
Date: Sat, 23 Nov 2024 00:59:45 +0100
Subject: [PATCH] ensure creation file date

---
 .../migrations/0003_ensure_creation_date.py   | 24 +++++++++++++++++++
 core/inventory/tests/v2/test_events.py        |  4 ++--
 core/inventory/tests/v2/test_items.py         | 17 +++++++++++++
 core/tickets/api_v2.py                        |  6 ++---
 4 files changed, 46 insertions(+), 5 deletions(-)
 create mode 100644 core/files/migrations/0003_ensure_creation_date.py

diff --git a/core/files/migrations/0003_ensure_creation_date.py b/core/files/migrations/0003_ensure_creation_date.py
new file mode 100644
index 0000000..63e5760
--- /dev/null
+++ b/core/files/migrations/0003_ensure_creation_date.py
@@ -0,0 +1,24 @@
+# Generated by Django 4.2.7 on 2024-11-21 22:40
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ('files', '0002_alter_file_file'),
+    ]
+
+    def set_creation_date(apps, schema_editor):
+        File = apps.get_model('files', 'File')
+        for file in File.objects.all():
+            if file.created_at is None:
+                if not file.item.created_at is None:
+                    file.created_at = file.item.created_at
+                else:
+                    file.created_at = max(File.objects.filter(
+                        id__lt=file.id, created_at__isnull=False).values_list('created_at', flat=True))
+                file.save()
+
+    operations = [
+        migrations.RunPython(set_creation_date),
+    ]
diff --git a/core/inventory/tests/v2/test_events.py b/core/inventory/tests/v2/test_events.py
index 6d6cadb..48ddb01 100644
--- a/core/inventory/tests/v2/test_events.py
+++ b/core/inventory/tests/v2/test_events.py
@@ -55,10 +55,10 @@ class EventTestCase(TestCase):
         self.assertEqual(response.status_code, 204)
         self.assertEqual(len(Event.objects.all()), 1)
 
-    def test_items2(self):
+    def test_event_with_address(self):
         from mail.models import EventAddress
         event1 = Event.objects.create(slug='TEST1', name='Event')
-        EventAddress.objects.create(event=Event.objects.get(slug='TEST1'), address='foo@bar.baz')
+        EventAddress.objects.create(event=event1, address='foo@bar.baz')
         response = self.client.get('/api/2/events/')
         self.assertEqual(response.status_code, 200)
         self.assertEqual(1, len(response.json()))
diff --git a/core/inventory/tests/v2/test_items.py b/core/inventory/tests/v2/test_items.py
index 59a5a4e..d289a70 100644
--- a/core/inventory/tests/v2/test_items.py
+++ b/core/inventory/tests/v2/test_items.py
@@ -56,6 +56,23 @@ class ItemTestCase(TestCase):
         self.assertEqual(response.json()[0]['event'], self.event.slug)
         self.assertEqual(len(response.json()[0]['related_issues']), 0)
 
+    def test_members_with_two_file(self):
+        import base64
+        item = Item.objects.create(container=self.box, event=self.event, description='1')
+        file1 = File.objects.create(item=item, data="data:text/plain;base64," + base64.b64encode(b"foo").decode('utf-8'))
+        file2 = File.objects.create(item=item, data="data:text/plain;base64," + base64.b64encode(b"bar").decode('utf-8'))
+        response = self.client.get(f'/api/2/{self.event.slug}/item/')
+        self.assertEqual(response.status_code, 200)
+        self.assertEqual(len(response.json()), 1)
+        self.assertEqual(response.json()[0]['id'], item.id)
+        self.assertEqual(response.json()[0]['description'], '1')
+        self.assertEqual(response.json()[0]['box'], 'BOX')
+        self.assertEqual(response.json()[0]['cid'], self.box.id)
+        self.assertEqual(response.json()[0]['file'], file2.hash)
+        self.assertEqual(response.json()[0]['returned'], False)
+        self.assertEqual(response.json()[0]['event'], self.event.slug)
+        self.assertEqual(len(response.json()[0]['related_issues']), 0)
+
     def test_multi_members(self):
         Item.objects.create(container=self.box, event=self.event, description='1')
         Item.objects.create(container=self.box, event=self.event, description='2')
diff --git a/core/tickets/api_v2.py b/core/tickets/api_v2.py
index e90da49..415e045 100644
--- a/core/tickets/api_v2.py
+++ b/core/tickets/api_v2.py
@@ -148,12 +148,12 @@ def filter_issues(issues, query):
 
 
 @api_view(['GET'])
-@permission_classes([])
-# @permission_classes([IsAuthenticated])
-# @permission_required('view_item', raise_exception=True)
+@permission_classes([IsAuthenticated])
 def search_issues(request, event_slug, query):
     try:
         event = Event.objects.get(slug=event_slug)
+        if not request.user.has_event_perm(event, 'view_issuethread'):
+            return Response(status=403)
         items = filter_issues(IssueThread.objects.filter(event=event), b64decode(query).decode('utf-8'))
         return Response(SearchResultSerializer(items, many=True).data)
     except Event.DoesNotExist: