Some refactoring to improve tests and allow users to access data

CHANGES.rst

@@ -5,8 +5,19 @@ Changelog
 1.0.1 (unreleased)
 ------------------
 
-- Nothing changed yet.
-
+- Only managers can access deleted feedbacks.
+  [cekk]
+- Allow all authenticated users to access @feedback endpoint.
+  The endpoint will return only feedbacks on objects that they can edit.
+  [cekk]
+- Improve tests.
+  [cekk]
+- Install souper.plone to have its control-panel in backend.
+  [cekk]
+- Remove unused user action.
+  [cekk]
+- Add `actions` infos in @feedback endpoint, to let the frontend know what the user can do.
+  [cekk]
 
 1.0.0 (2023-02-16)
 ------------------

base.cfg

@@ -17,6 +17,8 @@ parts =
     robot
     plone-helper-scripts
     vscode
+    zpretty
+    zpretty-run
 
 develop = .
 
@@ -109,6 +111,20 @@ scripts =
     zopepy
     plone-compile-resources
 
+[zpretty]
+recipe = zc.recipe.egg
+eggs =
+   zpretty
+
+[zpretty-run]
+recipe = collective.recipe.template
+input = inline:
+    #!/bin/bash
+    find src -name '*.zcml' | xargs bin/zpretty -i
+output = ${buildout:directory}/bin/zpretty-run
+mode = 755
+
+
 [versions]
 # Don't use a released version of collective.feedback
 collective.feedback =

setup.py

@@ -53,21 +53,23 @@
     python_requires=">=3.7",
     install_requires=[
         "setuptools",
-        # -*- Extra requirements: -*-
-        "z3c.jbot",
-        "plone.api>=1.8.4",
-        "plone.app.dexterity",
         "souper.plone",
+        "collective.honeypot>=2.1",
     ],
     extras_require={
         "test": [
+            "gocept.pytestlayer",
             "plone.app.testing",
-            # Plone KGS does not use this version, because it would break
-            # Remove if your package shall be part of coredev.
-            # plone_coredev tests as of 2016-04-01.
-            "plone.testing>=5.0.0",
-            "plone.app.contenttypes",
-            "plone.app.robotframework[debug]",
+            "plone.restapi[test]",
+            "pytest-cov",
+            "pytest-plone>=0.2.0",
+            "pytest-docker",
+            "pytest-mock",
+            "pytest",
+            "zest.releaser[recommended]",
+            "zestreleaser.towncrier",
+            "pytest-mock",
+            "requests-mock",
         ],
     },
     entry_points="""

src/collective/feedback/configure.zcml

@@ -9,10 +9,12 @@
   <i18n:registerTranslations directory="locales" />
 
   <include file="permissions.zcml" />
+  <include file="upgrades.zcml" />
 
   <include package=".storage" />
   <include package=".restapi" />
 
+
   <genericsetup:registerProfile
       name="default"
       title="collective.feedback"
@@ -31,6 +33,14 @@
       post_handler=".setuphandlers.uninstall"
       />
 
+  <genericsetup:registerProfile
+      name="to_1100"
+      title="collective.feedback (to_1100)"
+      description=""
+      provides="Products.GenericSetup.interfaces.EXTENSION"
+      directory="profiles/to_1100"
+      />
+
   <utility
       factory=".setuphandlers.HiddenProfiles"
       name="collective.feedback-hiddenprofiles"

src/collective/feedback/permissions.zcml

@@ -6,13 +6,22 @@
 
   <configure zcml:condition="installed AccessControl.security">
     <permission
-        id="collective.feedback.ManageFeedbacks"
-        title="collective.feedback: Manage Feedbacks"
+        id="collective.feedback.DeleteFeedbacks"
+        title="collective.feedback: Delete Feedbacks"
         />
     <permission
         id="collective.feedback.AccessFeedbacks"
         title="collective.feedback: Access Feedbacks"
         />
+    <permission
+        id="collective.feedback.FeedbacksOverview"
+        title="collective.feedback: Feedbacks Overview"
+        />
+    <permission
+        id="collective.feedback.ShowDeletedFeedbacks"
+        title="collective.feedback: Show Deleted Feedbacks"
+        />
+
   </configure>
 
 </configure>

src/collective/feedback/profiles/default/metadata.xml

@@ -1,7 +1,8 @@
 <?xml version="1.0" encoding="utf-8"?>
 <metadata>
-  <version>1000</version>
+  <version>1100</version>
   <dependencies>
-    <!--<dependency>profile-plone.app.dexterity:default</dependency>-->
+    <dependency>profile-plone.restapi:default</dependency>
+    <dependency>profile-souper.plone:default</dependency>
   </dependencies>
 </metadata>

src/collective/feedback/profiles/default/rolemap.xml

@@ -3,7 +3,7 @@
   <permissions>
 
     <permission acquire="True"
-                name="collective.feedback: Manage Feedbacks"
+                name="collective.feedback: Delete Feedbacks"
     >
       <role name="Manager" />
       <role name="Site Administrator" />
@@ -12,9 +12,19 @@
     <permission acquire="True"
                 name="collective.feedback: Access Feedbacks"
     >
+      <role name="Editor" />
       <role name="Manager" />
       <role name="Site Administrator" />
     </permission>
 
+    <permission acquire="True" name="collective.feedback: Feedbacks Overview">
+      <role name="Authenticated" />
+    </permission>
+
+    <permission acquire="True" name="collective.feedback: Show Deleted Feedbacks">
+      <role name="Manager" />
+      <role name="Site Administrator" />
+    </permission>
+
   </permissions>
 </rolemap>

src/collective/feedback/profiles/default/to_1100/rolemap.xml

@@ -0,0 +1,6 @@
+<?xml version="1.0" encoding="utf-8"?>
+<rolemap>
+  <permissions>
+    <permission remove="True" name="collective.feedback: Manage Feedbacks" />
+  </permissions>
+</rolemap>

src/collective/feedback/restapi/services/configure.zcml

@@ -17,23 +17,23 @@
       method="GET"
       factory=".get.FeedbackGet"
       for="plone.app.layout.navigation.interfaces.INavigationRoot"
-      permission="collective.feedback.AccessFeedbacks"
+      permission="collective.feedback.FeedbacksOverview"
       layer="collective.feedback.interfaces.ICollectiveFeedbackLayer"
       name="@feedback"
       />
   <plone:service
       method="GET"
       factory=".get.FeedbackGetCSV"
       for="plone.app.layout.navigation.interfaces.INavigationRoot"
-      permission="collective.feedback.AccessFeedbacks"
+      permission="collective.feedback.FeedbacksOverview"
       layer="collective.feedback.interfaces.ICollectiveFeedbackLayer"
       name="@feedback-csv"
       />
   <plone:service
       method="DELETE"
       factory=".delete.FeedbackDelete"
       for="plone.app.layout.navigation.interfaces.INavigationRoot"
-      permission="collective.feedback.ManageFeedbacks"
+      permission="collective.feedback.DeleteFeedbacks"
       layer="collective.feedback.interfaces.ICollectiveFeedbackLayer"
       name="@feedback-delete"
       />