first

apps/messaging/views.py

@@ -0,0 +1,28 @@
+from django.contrib.auth.decorators import login_required
+from django.core.exceptions import PermissionDenied
+from django.http import JsonResponse
+from django.shortcuts import get_object_or_404,redirect,render
+from django.utils.http import url_has_allowed_host_and_scheme
+from django.views.decorators.http import require_POST
+from .models import Message
+from .services import edit_message,soft_delete_message
+from apps.tickets.policies import TicketPolicy
+def _safe_next(request, fallback):
+    value=request.POST.get("next")
+    return value if value and url_has_allowed_host_and_scheme(value,allowed_hosts={request.get_host()},require_https=request.is_secure()) else fallback
+@login_required
+@require_POST
+def edit(request,public_id):
+    msg=get_object_or_404(Message,public_id=public_id)
+    try: edit_message(msg.pk,request.user,request.POST.get("body",""))
+    except (PermissionDenied,ValueError) as exc: raise PermissionDenied(str(exc))
+    return redirect(_safe_next(request,"/tickets/"))
+@login_required
+@require_POST
+def delete(request,public_id):
+    msg=get_object_or_404(Message,public_id=public_id); soft_delete_message(msg.pk,request.user); return redirect(_safe_next(request,"/staff/"))
+@login_required
+def revisions(request,public_id):
+    msg=get_object_or_404(Message,public_id=public_id)
+    if not request.user.has_perm("messaging.view_message_revisions") or not TicketPolicy.can_view(request.user,msg.ticket): raise PermissionDenied
+    return render(request,"messaging/revisions.html",{"message":msg,"revisions":msg.revisions.select_related("edited_by")})