From dc4f1549e8986f9e4e712659d47dd44b3ae450d6 Mon Sep 17 00:00:00 2001
From: Serghei Mihai <smihai@entrouvert.com>
Date: Wed, 13 Jun 2018 23:58:23 +0200
Subject: [PATCH] manager: forbid desk deletion with future bookings (#24415)

---
 chrono/manager/views.py | 15 +++++++++++++++
 tests/test_manager.py   | 31 +++++++++++++++++++++++++++++++
 2 files changed, 46 insertions(+)

diff --git a/chrono/manager/views.py b/chrono/manager/views.py
index 9b6786e..ae0c89a 100644
--- a/chrono/manager/views.py
+++ b/chrono/manager/views.py
@@ -507,6 +507,21 @@ class DeskDeleteView(ManagedAgendaSubobjectMixin, DeleteView):
     template_name = 'chrono/manager_confirm_delete.html'
     model = Desk
 
+    def get_context_data(self, **kwargs):
+        context = super(DeskDeleteView, self).get_context_data(**kwargs)
+        context['cannot_delete'] = Booking.objects.filter(
+                event__desk=self.get_object(),
+                event__start_datetime__gt=now(),
+                cancellation_datetime__isnull=True).exists()
+        return context
+
+    def delete(self, request, *args, **kwargs):
+        self.object = self.get_object()
+        context = self.get_context_data()
+        if context['cannot_delete']:
+            raise PermissionDenied()
+        return super(DeskDeleteView, self).delete(request, *args, **kwargs)
+
 
 desk_delete = DeskDeleteView.as_view()
 
diff --git a/tests/test_manager.py b/tests/test_manager.py
index 918f796..7f3c863 100644
--- a/tests/test_manager.py
+++ b/tests/test_manager.py
@@ -276,6 +276,37 @@ def test_delete_agenda_as_manager(app, manager_user):
     assert 'Delete' not in resp.text
     resp = app.get('/manage/agendas/%s/delete' % agenda.id, status=403)
 
+
+def test_delete_busy_desk(app, admin_user):
+    agenda = Agenda(label=u'Foo bar', kind='meetings')
+    agenda.save()
+    desk_a = Desk.objects.create(agenda=agenda, label='Desk A')
+    desk_b = Desk.objects.create(agenda=agenda, label='Desk B')
+
+    event = Event(start_datetime=now() + datetime.timedelta(days=10),
+                  places=10, agenda=agenda, desk=desk_a)
+    event.save()
+
+    app = login(app)
+    resp = app.get('/manage/', status=200)
+    resp = resp.click('Foo bar').follow()
+    resp = resp.click('Settings')
+    desk_page = resp.click('Desk A')
+    desk_delete_page = desk_page.click('Delete')
+    assert 'Are you sure you want to delete this?' in desk_delete_page.text
+    # make sure the deleting is not disabled
+    assert 'disabled' not in desk_delete_page.text
+
+    booking = Booking(event=event)
+    booking.save()
+
+    resp = desk_page.click('Delete')
+    assert 'This cannot be removed' in resp.text
+    # the button is disabled
+    assert 'disabled' in resp.text
+    app.post('/manage/desks/%s/delete' % desk_a.pk, status=403)
+
+
 def test_add_event(app, admin_user):
     agenda = Agenda(label=u'Foo bar')
     agenda.maximal_booking_delay = 0
-- 
2.17.1