Minor fixes

back/boxtribute_server/business_logic/beneficiary/fields.py

@@ -80,3 +80,13 @@ def resolve_beneficiary_active(beneficiary_obj, _):
 def resolve_beneficiary_base(beneficiary_obj, info):
     authorize(permission="base:read", base_id=beneficiary_obj.base_id)
     return info.context["base_loader"].load(beneficiary_obj.base_id)
+
+
+@beneficiary.field("createdBy")
+def resolve_beneficiary_created_by(beneficiary_obj, info):
+    return info.context["user_loader"].load(beneficiary_obj.created_by_id)
+
+
+@beneficiary.field("lastModifiedBy")
+def resolve_beneficiary_last_modified_by(beneficiary_obj, info):
+    return info.context["user_loader"].load(beneficiary_obj.last_modified_by_id)

back/boxtribute_server/business_logic/box_transfer/shipment/crud.py

@@ -264,22 +264,22 @@ def _update_shipment_with_prepared_boxes(
         )
     )
     details = [
-        {
-            "shipment": shipment.id,
-            "box": box.id,
-            "source_product": box.product_id,
-            "source_location": box.location_id,
-            "source_size": box.size_id,
-            "source_quantity": box.number_of_items,
-            "created_by": user_id,
-        }
+        ShipmentDetail(
+            shipment=shipment.id,
+            box=box.id,
+            source_product=box.product_id,
+            source_location=box.location_id,
+            source_size=box.size_id,
+            source_quantity=box.number_of_items,
+            created_by=user_id,
+        )
         for box in boxes
     ]
 
     _bulk_update_box_state(
         boxes=boxes, state=BoxState.MarkedForShipment, user_id=user_id, now=now
     )
-    ShipmentDetail.insert_many(details).execute()
+    ShipmentDetail.bulk_create(details, batch_size=BATCH_SIZE)
 
 
 def _remove_boxes_from_shipment(

back/boxtribute_server/business_logic/warehouse/box/fields.py

@@ -67,6 +67,16 @@ def resolve_box_shipment_detail(box_obj, info):
     return info.context["shipment_detail_for_box_loader"].load(box_obj.id)
 
 
+@box.field("createdBy")
+def resolve_box_created_by(box_obj, info):
+    return info.context["user_loader"].load(box_obj.created_by_id)
+
+
+@box.field("lastModifiedBy")
+def resolve_box_last_modified_by(box_obj, info):
+    return info.context["user_loader"].load(box_obj.last_modified_by_id)
+
+
 @history_entry.field("user")
 def resolve_history_entry_user(history_entry_obj, info):
     return info.context["user_loader"].load(history_entry_obj.user_id)

back/boxtribute_server/business_logic/warehouse/location/fields.py

@@ -31,3 +31,13 @@ def resolve_location_boxes(location_obj, _, pagination_input=None, filter_input=
 def resolve_location_base(location_obj, info):
     authorize(permission="base:read", base_id=location_obj.base_id)
     return info.context["base_loader"].load(location_obj.base_id)
+
+
+@classic_location.field("createdBy")
+def resolve_location_created_by(location_obj, info):
+    return info.context["user_loader"].load(location_obj.created_by_id)
+
+
+@classic_location.field("lastModifiedBy")
+def resolve_location_last_modified_by(location_obj, info):
+    return info.context["user_loader"].load(location_obj.last_modified_by_id)

back/boxtribute_server/business_logic/warehouse/product/fields.py

@@ -33,3 +33,13 @@ def resolve_product_type(product_obj, _):
     if product_obj.standard_product_id is None:
         return ProductType.Custom
     return ProductType.StandardInstantiation
+
+
+@product.field("createdBy")
+def resolve_product_created_by(product_obj, info):
+    return info.context["user_loader"].load(product_obj.created_by_id)
+
+
+@product.field("lastModifiedBy")
+def resolve_product_last_modified_by(product_obj, info):
+    return info.context["user_loader"].load(product_obj.last_modified_by_id)

back/boxtribute_server/graph_ql/definitions/protected/types.graphql

@@ -26,9 +26,11 @@ type Box implements ItemsCollection {
   id: ID!
   " Sequence of numbers for identifying the box, usually written on box label "
   labelIdentifier: String!
+  " If the client is not authorized to access the location's base, return `null` instead of raising an authorization error. This enables the target side of a shipment to scan boxes that are not yet reconciliated into their stock (but still registered at the source side) "
   location: Location
   distributionEvent: DistributionEvent
   numberOfItems: Int
+  " If the client is not authorized to access the product's base, return `null` instead of raising an authorization error. This enables the target side of a shipment to scan boxes that are not yet reconciliated into their stock (but still registered at the source side) "
   product: Product
   size: Size!
   state: BoxState!

back/boxtribute_server/models/definitions/beneficiary.py

@@ -61,6 +61,7 @@ class Beneficiary(db.Model):  # type: ignore
         null=True,
         on_delete="SET NULL",
         on_update="CASCADE",
+        object_id_name="last_modified_by_id",
     )
     not_registered = IntegerField(
         column_name="notregistered", constraints=[SQL("DEFAULT 0")], default=False

back/boxtribute_server/models/definitions/box.py

@@ -68,6 +68,7 @@ class Box(db.Model):  # type: ignore
         null=True,
         on_delete="SET NULL",
         on_update="CASCADE",
+        object_id_name="last_modified_by_id",
     )
     product = UIntForeignKeyField(
         column_name="product_id",

back/boxtribute_server/models/definitions/location.py

@@ -53,6 +53,7 @@ class Location(db.Model):  # type: ignore
         null=True,
         on_delete="SET NULL",
         on_update="CASCADE",
+        object_id_name="last_modified_by_id",
     )
     seq = IntegerField(null=True)
     visible = IntegerField(constraints=[SQL("DEFAULT 1")])

back/boxtribute_server/models/definitions/product.py

@@ -55,6 +55,7 @@ class Product(db.Model):  # type: ignore
         null=True,
         on_delete="SET NULL",
         on_update="CASCADE",
+        object_id_name="last_modified_by_id",
     )
     name = CharField()
     size_range = UIntForeignKeyField(

back/test/endpoint_tests/test_box.py

@@ -34,6 +34,7 @@ def test_box_query_by_label_identifier(
                     state
                     qrCode {{ id }}
                     createdBy {{ id }}
+                    lastModifiedBy {{ id }}
                     deletedOn
                     comment
                     tags {{
@@ -56,6 +57,7 @@ def test_box_query_by_label_identifier(
         "state": BoxState.InStock.name,
         "qrCode": {"id": str(default_box["qr_code"])},
         "createdBy": {"id": str(default_box["created_by"])},
+        "lastModifiedBy": {"id": str(default_box["last_modified_by"])},
         "deletedOn": None,
         "comment": None,
         "tags": [
@@ -584,7 +586,10 @@ def test_box_mutations(
         "updatedBoxes": [
             {"id": str(another_box["id"]), "location": {"id": another_location_id}}
         ],
-        "invalidBoxLabelIdentifiers": [created_box["labelIdentifier"], "99119911"],
+        # Identifiers will be alphabetically sorted in the response
+        "invalidBoxLabelIdentifiers": sorted(
+            [created_box["labelIdentifier"], "99119911"]
+        ),
     }
 
     # Test cases 8.2.1, 8.2.2., 8.2.11, 8.2.25

back/test/endpoint_tests/test_classic_location.py

@@ -30,6 +30,8 @@ def test_location_query(
                     defaultBoxState
                     createdOn
                     createdBy {{ id }}
+                    lastModifiedOn
+                    lastModifiedBy {{ id }}
                 }}
             }}"""
     queried_location = assert_successful_request(read_only_client, query)
@@ -44,6 +46,8 @@ def test_location_query(
         "defaultBoxState": BoxState(default_location["box_state"]).name,
         "createdOn": None,
         "createdBy": {"id": str(default_location["created_by"])},
+        "lastModifiedOn": None,
+        "lastModifiedBy": None,
     }
 
     query = f"""query {{ location(id: "{distribution_spot['id']}") {{ id }} }}"""

back/test/endpoint_tests/test_permissions.py

@@ -396,6 +396,15 @@ def test_invalid_permission_for_box_field(read_only_client, mocker, default_box,
     assert_forbidden_request(read_only_client, query, value={field: None})
 
 
+def test_invalid_permission_for_box_size(read_only_client, mocker, default_box):
+    # Test case 8.1.9
+    # verify missing size:read permission
+    mock_user_for_request(mocker, permissions=["stock:read"])
+    query = f"""query {{ box(labelIdentifier: "{default_box["label_identifier"]}")
+                {{ size {{ id }} }} }}"""
+    assert_forbidden_request(read_only_client, query)
+
+
 @pytest.mark.parametrize(
     "field", ["sourceLocation", "targetLocation", "sourceProduct", "targetProduct"]
 )

back/test/endpoint_tests/test_product.py

@@ -25,6 +25,8 @@ def test_product_query(read_only_client, default_product, default_size, another_
                     gender
                     comment
                     createdBy {{ id }}
+                    lastModifiedOn
+                    lastModifiedBy {{ id }}
                     deletedOn
                 }}
             }}"""
@@ -43,6 +45,8 @@ def test_product_query(read_only_client, default_product, default_size, another_
         "comment": default_product["comment"],
         "gender": "Women",
         "createdBy": {"id": str(default_product["created_by"])},
+        "lastModifiedOn": None,
+        "lastModifiedBy": None,
         "deletedOn": default_product["deleted_on"],
     }
 

front/src/types/generated/graphql.ts

@@ -208,8 +208,10 @@ export type Box = ItemsCollection & {
   labelIdentifier: Scalars['String'];
   lastModifiedBy?: Maybe<User>;
   lastModifiedOn?: Maybe<Scalars['Datetime']>;
+  /**  If the client is not authorized to access the location's base, return `null` instead of raising an authorization error. This enables the target side of a shipment to scan boxes that are not yet reconciliated into their stock (but still registered at the source side)  */
   location?: Maybe<Location>;
   numberOfItems?: Maybe<Scalars['Int']>;
+  /**  If the client is not authorized to access the product's base, return `null` instead of raising an authorization error. This enables the target side of a shipment to scan boxes that are not yet reconciliated into their stock (but still registered at the source side)  */
   product?: Maybe<Product>;
   qrCode?: Maybe<QrCode>;
   /**  Returns null if box is not part of an active shipment  */