From be92075abbd108c5f1c1fd11be20c38ef77b51a6 Mon Sep 17 00:00:00 2001
From: Lance Edgar <lance@edbob.org>
Date: Wed, 8 Dec 2021 20:26:31 -0600
Subject: [PATCH] Allow "auto-receive all items" batch feature in production

but require a dedicated permission
---
 tailbone/templates/receiving/view.mako | 43 ++++++++++++--------------
 tailbone/views/purchasing/receiving.py | 31 ++++++++++++++++---
 2 files changed, 45 insertions(+), 29 deletions(-)

diff --git a/tailbone/templates/receiving/view.mako b/tailbone/templates/receiving/view.mako
index 32c327fe..df42de47 100644
--- a/tailbone/templates/receiving/view.mako
+++ b/tailbone/templates/receiving/view.mako
@@ -285,31 +285,26 @@
 
 <%def name="object_helpers()">
   ${parent.object_helpers()}
-  ## TODO: for now this is a truck-dump-only feature? maybe should change that
-  % if not request.rattail_config.production() and master.handler.allow_truck_dump_receiving():
-      % if not batch.executed and not batch.complete and request.has_perm('admin'):
-          % if (batch.is_truck_dump_parent() and batch.truck_dump_children_first) or not batch.is_truck_dump_related():
-              <div class="object-helper">
-                <h3>Development Tools</h3>
-                <div class="object-helper-content">
-                  % if use_buefy:
-                      ${h.form(url('{}.auto_receive'.format(route_prefix), uuid=batch.uuid), ref='auto_receive_all_form')}
-                      ${h.csrf_token(request)}
-                      <once-button type="is-primary"
-                                   @click="$refs.auto_receive_all_form.submit()"
-                                   text="Auto-Receive All Items">
-                      </once-button>
-                      ${h.end_form()}
-                  % else:
-                      ${h.form(url('{}.auto_receive'.format(route_prefix), uuid=batch.uuid), class_='autodisable')}
-                      ${h.csrf_token(request)}
-                      ${h.submit('submit', "Auto-Receive All Items")}
-                      ${h.end_form()}
-                  % endif
-                </div>
-              </div>
+  % if master.has_perm('auto_receive') and master.can_auto_receive(batch):
+      <div class="object-helper">
+        <h3>Tools</h3>
+        <div class="object-helper-content">
+          % if use_buefy:
+              ${h.form(url('{}.auto_receive'.format(route_prefix), uuid=batch.uuid), ref='auto_receive_all_form')}
+              ${h.csrf_token(request)}
+              <once-button type="is-primary"
+                           @click="$refs.auto_receive_all_form.submit()"
+                           text="Auto-Receive All Items">
+              </once-button>
+              ${h.end_form()}
+          % else:
+              ${h.form(url('{}.auto_receive'.format(route_prefix), uuid=batch.uuid), class_='autodisable')}
+              ${h.csrf_token(request)}
+              ${h.submit('submit', "Auto-Receive All Items")}
+              ${h.end_form()}
           % endif
-      % endif
+        </div>
+      </div>
   % endif
 </%def>
 
diff --git a/tailbone/views/purchasing/receiving.py b/tailbone/views/purchasing/receiving.py
index a3b17c16..f0fc3e12 100644
--- a/tailbone/views/purchasing/receiving.py
+++ b/tailbone/views/purchasing/receiving.py
@@ -1469,6 +1469,24 @@ class ReceivingBatchView(PurchasingBatchView):
         if self.rattail_config.getbool('rattail.batch', 'purchase.mobile_images', default=True):
             return pod.get_image_url(self.rattail_config, row.upc)
 
+    def can_auto_receive(self, batch):
+        if batch.executed:
+            return False
+        if batch.complete:
+            return False
+
+        if batch.is_truck_dump_related():
+            if not batch.is_truck_dump_parent():
+                return False
+            if not batch.truck_dump_children_first():
+                return False
+
+        # only auto-receive once per batch
+        if batch.get_param('auto_received'):
+            return False
+
+        return True
+
     def auto_receive(self):
         """
         View which can "auto-receive" all items in the batch.  Meant only as a
@@ -1535,6 +1553,7 @@ class ReceivingBatchView(PurchasingBatchView):
         url_prefix = cls.get_url_prefix()
         instance_url_prefix = cls.get_instance_url_prefix()
         model_key = cls.get_model_key()
+        model_title = cls.get_model_title()
         permission_prefix = cls.get_permission_prefix()
 
         # new receiving batch using workflow X
@@ -1569,11 +1588,13 @@ class ReceivingBatchView(PurchasingBatchView):
                         permission='{}.edit_row'.format(permission_prefix), renderer='json')
 
         # auto-receive all items
-        if not rattail_config.production():
-            config.add_route('{}.auto_receive'.format(route_prefix), '{}/auto-receive'.format(instance_url_prefix),
-                             request_method='POST')
-            config.add_view(cls, attr='auto_receive', route_name='{}.auto_receive'.format(route_prefix),
-                            permission='admin')
+        config.add_tailbone_permission(permission_prefix,
+                                       '{}.auto_receive'.format(permission_prefix),
+                                       "Auto-receive all items for a {}".format(model_title))
+        config.add_route('{}.auto_receive'.format(route_prefix), '{}/auto-receive'.format(instance_url_prefix),
+                         request_method='POST')
+        config.add_view(cls, attr='auto_receive', route_name='{}.auto_receive'.format(route_prefix),
+                        permission='{}.auto_receive'.format(permission_prefix))
 
 
 @colander.deferred