From 8e14f4a2983c22d31c7fdbb37dd3f2adb3b16d7c Mon Sep 17 00:00:00 2001
From: Dimas Ciputra <dimas.ciputra@gmail.com>
Date: Fri, 15 Nov 2024 15:43:22 +0000
Subject: [PATCH] Hide unvalidated taxon to non expert/superuser (#4347)

* Hide unvalidated taxon to non expert/superuser

* Fix test
---
 bims/api_views/taxon.py                  | 15 ++++++++++++---
 bims/models/location_site.py             |  2 +-
 bims/tests/test_location_context.py      |  2 +-
 bims/tests/test_review_taxon_proposal.py |  8 ++++----
 mobile/api_views/taxon_group.py          | 14 +++++++++++---
 5 files changed, 29 insertions(+), 12 deletions(-)

diff --git a/bims/api_views/taxon.py b/bims/api_views/taxon.py
index c7e830044..12c702136 100644
--- a/bims/api_views/taxon.py
+++ b/bims/api_views/taxon.py
@@ -577,9 +577,18 @@ def get_taxa_by_parameters(request):
             try:
                 validated = ast.literal_eval(validated.replace('/', ''))
                 if not validated:
-                    validated_filters = {
-                        'taxongrouptaxonomy__is_validated': False,
-                    }
+                    # Check if the user is a superuser or has expert permissions for the taxon group
+                    is_user_expert = is_expert(
+                        request.user,
+                        TaxonGroup.objects.get(id=taxon_group_id)
+                    )
+                    if request.user.is_superuser or is_user_expert:
+                        validated_filters = {
+                            'taxongrouptaxonomy__is_validated': False,
+                        }
+                    else:
+                        taxon_list = taxon_list.none()
+                        return taxon_list
                 else:
                     validated_filters = {
                         'taxongrouptaxonomy__is_validated': True,
diff --git a/bims/models/location_site.py b/bims/models/location_site.py
index 013932d5a..7fbc5b805 100644
--- a/bims/models/location_site.py
+++ b/bims/models/location_site.py
@@ -332,7 +332,7 @@ def add_context_group(self, group_key):
                     table_name=layer.query_table_name,
                     field_names=[context_key],
                     coordinates=[(self.longitude, self.latitude)],
-                    tolerance=10
+                    tolerance=0
                 )
                 # Find by name first
                 context_groups = LocationContextGroup.objects.filter(
diff --git a/bims/tests/test_location_context.py b/bims/tests/test_location_context.py
index 96ba06169..8f3b4c477 100644
--- a/bims/tests/test_location_context.py
+++ b/bims/tests/test_location_context.py
@@ -121,7 +121,7 @@ def test_add_location_context_from_native_layer(self, mock_query_features):
             table_name=layer.query_table_name,
             field_names=[context_key],
             coordinates=[(location_site.longitude, location_site.latitude)],
-            tolerance=10
+            tolerance=0
         )
 
         location_context_group = LocationContextGroup.objects.filter(
diff --git a/bims/tests/test_review_taxon_proposal.py b/bims/tests/test_review_taxon_proposal.py
index 63e6d1738..b7bc148ba 100644
--- a/bims/tests/test_review_taxon_proposal.py
+++ b/bims/tests/test_review_taxon_proposal.py
@@ -182,8 +182,8 @@ def test_expert_approve_taxon(self):
         taxa_list_url = reverse('taxa-list')
         unvalidated_taxa_list_url = f'{taxa_list_url}?taxonGroup={taxon_group_level_3.id}&validated=False'
         response = self.client.get(unvalidated_taxa_list_url)
-        self.assertFalse(
-            response.data['results'][0]['can_be_validated']
+        self.assertEqual(
+            len(response.data['results']), 0
         )
 
         # The expert of taxon group level 2 validates the taxa.
@@ -217,8 +217,8 @@ def test_expert_approve_taxon(self):
         self.client.login(username='experts_2', password='password')
         unvalidated_taxa_list_url = f'{taxa_list_url}?taxonGroup={self.taxon_group.id}&validated=False'
         response = self.client.get(unvalidated_taxa_list_url)
-        self.assertFalse(
-            response.data['results'][0]['can_be_validated']
+        self.assertEqual(
+            len(response.data['results']), 0
         )
 
         # The expert of taxon group level 1 validates the taxa.
diff --git a/mobile/api_views/taxon_group.py b/mobile/api_views/taxon_group.py
index a55c4e90f..8dac10060 100644
--- a/mobile/api_views/taxon_group.py
+++ b/mobile/api_views/taxon_group.py
@@ -2,6 +2,7 @@
 from rest_framework.response import Response
 from rest_framework.views import APIView
 
+from bims.api_views.taxon_update import is_expert
 from bims.models.taxon_group import TaxonGroup
 from bims.serializers.taxon_serializer import TaxonGroupSerializer
 from bims.enums.taxonomic_group_category import TaxonomicGroupCategory
@@ -40,9 +41,16 @@ def collect_taxonomy_ids(self, taxon_group):
         validated = taxon_group.taxonomies.filter(
             taxongrouptaxonomy__is_validated=True
         ).count()
-        unvalidated = taxon_group.taxonomies.filter(
-            taxongrouptaxonomy__is_validated=False
-        ).count()
+        is_user_expert = is_expert(
+            self.request.user,
+            TaxonGroup.objects.get(id=taxon_group.id)
+        )
+        if self.request.user.is_superuser or is_user_expert:
+            unvalidated = taxon_group.taxonomies.filter(
+                taxongrouptaxonomy__is_validated=False
+            ).count()
+        else:
+            unvalidated = 0
 
         self.validated_count += validated
         self.unvalidated_count += unvalidated