Add editing trusted gallery users to API

app.py

@@ -1740,3 +1740,63 @@ def api_gallery_remove_picture(id):

                                
                                
                                
                            
                                
                                    
                                        
                                            1740  
                                            
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            1741  
                                                return flask.jsonify({"message": "Picture removed from gallery"})
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        
                                            1742  
                                            
                                        
                                        
                                            
                                            
                                            
                                            
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1743 +
                                        
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1744 +
                                        @app.route("/api/gallery/<int:id>/users/add", methods=["POST"])
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1745 +
                                        def api_gallery_add_user(id):
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1746 +
                                            gallery = db.session.get(Gallery, id)
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1747 +
                                            if gallery is None:
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1748 +
                                                flask.abort(404)
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1749 +
                                        
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1750 +
                                            current_user = db.session.get(User, flask.session.get("username"))
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1751 +
                                            if current_user is None:
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1752 +
                                                flask.abort(401)
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1753 +
                                        
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1754 +
                                            if current_user != gallery.owner and not current_user.admin:
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1755 +
                                                flask.abort(403)
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1756 +
                                        
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1757 +
                                            username = flask.request.json.get("username")
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1758 +
                                            if username == gallery.owner_name:
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1759 +
                                                return flask.jsonify({"error": "The owner cannot be added to trusted users"}), 400
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1760 +
                                        
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1761 +
                                            user = db.session.get(User, username)
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1762 +
                                            if user is None:
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1763 +
                                                return flask.jsonify({"error": "User not found"}), 404
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1764 +
                                        
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1765 +
                                            if UserInGallery.query.filter_by(user=user, gallery=gallery).first():
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1766 +
                                                return flask.jsonify({"error": "User is already in the gallery"}), 400
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1767 +
                                        
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1768 +
                                            db.session.add(UserInGallery(user, gallery))
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1769 +
                                        
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1770 +
                                            db.session.commit()
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1771 +
                                        
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1772 +
                                            return flask.jsonify({"message": "User added to gallery"})
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1773 +
                                        
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1774 +
                                        
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1775 +
                                        @app.route("/api/gallery/<int:id>/users/remove", methods=["POST"])
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1776 +
                                        def api_gallery_remove_user(id):
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1777 +
                                            gallery = db.session.get(Gallery, id)
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1778 +
                                            if gallery is None:
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1779 +
                                                flask.abort(404)
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1780 +
                                        
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1781 +
                                            current_user = db.session.get(User, flask.session.get("username"))
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1782 +
                                            if current_user is None:
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1783 +
                                                flask.abort(401)
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1784 +
                                        
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1785 +
                                            if current_user != gallery.owner and not current_user.admin:
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1786 +
                                                flask.abort(403)
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1787 +
                                        
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1788 +
                                            username = flask.request.json.get("username")
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1789 +
                                            user = db.session.get(User, username)
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1790 +
                                            if user is None:
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1791 +
                                                return flask.jsonify({"error": "User not found"}), 404
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1792 +
                                        
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1793 +
                                            user_in_gallery = UserInGallery.query.filter_by(user=user, gallery=gallery).first()
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1794 +
                                            if user_in_gallery is None:
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1795 +
                                                return flask.jsonify({"error": "User is not in the gallery"}), 400
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1796 +
                                        
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1797 +
                                            db.session.delete(user_in_gallery)
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1798 +
                                        
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1799 +
                                            db.session.commit()
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1800 +
                                        
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1801 +
                                            return flask.jsonify({"message": "User removed from gallery"})
                                        
                                        
                                        
                                    
                                
                                
                                
                            
                                
                                    
                                        1802 +