diff options
Diffstat (limited to 'pyaggr3g470r/controllers')
| -rw-r--r-- | pyaggr3g470r/controllers/abstract.py | 9 | ||||
| -rw-r--r-- | pyaggr3g470r/controllers/article.py | 9 |
2 files changed, 16 insertions, 2 deletions
diff --git a/pyaggr3g470r/controllers/abstract.py b/pyaggr3g470r/controllers/abstract.py index f1173817..8f0a8e3f 100644 --- a/pyaggr3g470r/controllers/abstract.py +++ b/pyaggr3g470r/controllers/abstract.py @@ -56,8 +56,8 @@ class AbstractController(object): if not obj: raise NotFound({'message': 'No %r (%r)' % (self._db_cls.__class__.__name__, filters)}) - if self.user_id is not None \ - and getattr(obj, self._user_id_key) != self.user_id: + + if not self._has_right_on(obj): raise Forbidden({'message': 'No authorized to access %r (%r)' % (self._db_cls.__class__.__name__, filters)}) return obj @@ -84,3 +84,8 @@ class AbstractController(object): db.session.delete(obj) db.session.commit() return obj + + def _has_right_on(self, obj): + # user_id == None is like being admin + return self.user_id is None \ + or getattr(obj, self._user_id_key, None) == self.user_id diff --git a/pyaggr3g470r/controllers/article.py b/pyaggr3g470r/controllers/article.py index 46ca0988..0ec53a2f 100644 --- a/pyaggr3g470r/controllers/article.py +++ b/pyaggr3g470r/controllers/article.py @@ -1,3 +1,6 @@ +from sqlalchemy import func + +from bootstrap import db import conf from .abstract import AbstractController from pyaggr3g470r.models import Article @@ -25,3 +28,9 @@ class ArticleController(AbstractController): if self.read(**id_).first(): continue yield id_ + + def get_unread(self): + return dict(db.session.query(Article.feed_id, func.count(Article.id)) + .filter(Article.readed == False, + Article.user_id == self.user_id) + .group_by(Article.feed_id).all()) |