From fc2fda7c3a5d783ffdc0558d6cb7ce15a4b41070 Mon Sep 17 00:00:00 2001
From: Lance Edgar <lance@edbob.org>
Date: Thu, 12 Oct 2023 11:58:21 -0500
Subject: [PATCH] Require permission to remove or replace customer in txn

---
 wuttapos/views/pos.py | 71 +++++++++++++++++++++++++++----------------
 1 file changed, 44 insertions(+), 27 deletions(-)

diff --git a/wuttapos/views/pos.py b/wuttapos/views/pos.py
index a7be203..2eab486 100644
--- a/wuttapos/views/pos.py
+++ b/wuttapos/views/pos.py
@@ -87,11 +87,14 @@ class POSView(WuttaView):
 
         self.page.update()
 
-    def set_customer(self, customer, batch=None):
+    def set_customer(self, customer, batch=None, user=None):
         session = self.app.get_session(customer)
-        user = self.get_current_user(session)
         if not batch:
-            batch = self.get_current_batch(session, user=user)
+            batch = self.get_current_batch(session)
+        if user:
+            user = session.get(user.__class__, user.uuid)
+        else:
+            user = self.get_current_user(session)
 
         handler = self.get_batch_handler()
         handler.set_customer(batch, customer, user=user)
@@ -209,12 +212,12 @@ class POSView(WuttaView):
         dlg.open = True
         self.page.update()
 
-    def customer_lookup(self, value=None):
+    def customer_lookup(self, value=None, user=None):
 
         def select(uuid):
             session = self.app.make_session()
             customer = session.get(self.model.Customer, uuid)
-            self.set_customer(customer)
+            self.set_customer(customer, user=user)
             session.commit()
             session.close()
 
@@ -330,15 +333,12 @@ class POSView(WuttaView):
             dlg.open = False
             self.page.update()
 
+            # nb. do this just in case we must show login dialog
             # cf. https://github.com/flet-dev/flet/issues/1670
             time.sleep(0.1)
 
-            entry = self.main_input.value
-            if entry:
-                if not self.attempt_set_customer(entry):
-                    self.customer_lookup(entry)
-            else:
-                self.customer_lookup()
+            self.authorized_action('pos.swap_customer', self.replace_customer,
+                                   message="Replace Customer")
 
         def cancel(e):
             dlg.open = False
@@ -400,21 +400,15 @@ class POSView(WuttaView):
     def remove_customer_prompt(self):
 
         def remove(e):
-            session = self.app.make_session()
-            user = self.get_current_user(session)
-            handler = self.get_batch_handler()
-            batch = self.get_current_batch(session, user=user)
-            handler.set_customer(batch, None, user=user)
-            session.commit()
-            session.close()
-
-            self.page.session.set('cust_uuid', None)
-            self.page.session.set('cust_display', None)
-            self.informed_refresh()
-
             dlg.open = False
-            self.show_snackbar("CUSTOMER REMOVED", bgcolor='yellow')
-            self.reset()
+            self.page.update()
+
+            # nb. do this just in case we must show login dialog
+            # cf. https://github.com/flet-dev/flet/issues/1670
+            time.sleep(0.1)
+
+            self.authorized_action('pos.del_customer', self.remove_customer,
+                                   message="Remove Customer")
 
         def cancel(e):
             dlg.open = False
@@ -450,13 +444,36 @@ class POSView(WuttaView):
         dlg.open = True
         self.page.update()
 
-    def attempt_set_customer(self, entry=None):
+    def remove_customer(self, user):
+        session = self.app.make_session()
+        handler = self.get_batch_handler()
+        batch = self.get_current_batch(session)
+        user = session.get(user.__class__, user.uuid)
+        handler.set_customer(batch, None, user=user)
+        session.commit()
+        session.close()
+
+        self.page.session.set('cust_uuid', None)
+        self.page.session.set('cust_display', None)
+        self.informed_refresh()
+        self.show_snackbar("CUSTOMER REMOVED", bgcolor='yellow')
+        self.reset()
+
+    def replace_customer(self, user):
+        entry = self.main_input.value
+        if entry:
+            if not self.attempt_set_customer(entry, user=user):
+                self.customer_lookup(entry, user=user)
+        else:
+            self.customer_lookup(user=user)
+
+    def attempt_set_customer(self, entry=None, user=None):
         session = self.app.make_session()
 
         customer = self.app.get_clientele_handler().locate_customer_for_entry(session, entry)
         if customer:
 
-            self.set_customer(customer)
+            self.set_customer(customer, user=user)
             self.reset()
 
         else: # customer not found