From 034e47bc282a43b661b6d5db2759b4c8ca723a3f Mon Sep 17 00:00:00 2001
From: Leonidas Spyropoulos <artafinde@archlinux.org>
Date: Thu, 19 May 2022 13:13:36 +0100
Subject: [PATCH] fix: hide Unflag package from non-maintainers

Closes: #364
Signed-off-by: Leonidas Spyropoulos <artafinde@archlinux.org>
---
 aurweb/pkgbase/actions.py                | 4 ++--
 aurweb/pkgbase/util.py                   | 3 +++
 templates/partials/packages/actions.html | 2 ++
 3 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/aurweb/pkgbase/actions.py b/aurweb/pkgbase/actions.py
index 229d52b9..6fd55497 100644
--- a/aurweb/pkgbase/actions.py
+++ b/aurweb/pkgbase/actions.py
@@ -38,8 +38,8 @@ def pkgbase_unnotify_instance(request: Request, pkgbase: PackageBase) -> None:
 
 
 def pkgbase_unflag_instance(request: Request, pkgbase: PackageBase) -> None:
-    has_cred = request.user.has_credential(
-        creds.PKGBASE_UNFLAG, approved=[pkgbase.Flagger, pkgbase.Maintainer])
+    has_cred = request.user.has_credential(creds.PKGBASE_UNFLAG, approved=[
+                                           pkgbase.Flagger, pkgbase.Maintainer] + [c.User for c in pkgbase.comaintainers])
     if has_cred:
         with db.begin():
             pkgbase.OutOfDateTS = None
diff --git a/aurweb/pkgbase/util.py b/aurweb/pkgbase/util.py
index ea952dce..55dbb022 100644
--- a/aurweb/pkgbase/util.py
+++ b/aurweb/pkgbase/util.py
@@ -39,6 +39,9 @@ def make_context(request: Request, pkgbase: PackageBase,
             PackageComaintainer.Priority.asc()
         ).all()
     ]
+    context["unflaggers"] = context["comaintainers"].copy()
+    context["unflaggers"].append(pkgbase.Maintainer)
+
     context["packages_count"] = pkgbase.packages.count()
     context["keywords"] = pkgbase.keywords
     context["comments"] = pkgbase.comments.order_by(
diff --git a/templates/partials/packages/actions.html b/templates/partials/packages/actions.html
index 88420222..2144b07a 100644
--- a/templates/partials/packages/actions.html
+++ b/templates/partials/packages/actions.html
@@ -41,6 +41,7 @@
                         </a>
                     </span>
                 </li>
+                {% if request.user.has_credential(creds.PKGBASE_UNFLAG, approved=unflaggers) %}
                 <li>
                     <form action="/pkgbase/{{ pkgbase.Name }}/unflag" method="post">
                         <input class="button text-button"
@@ -50,6 +51,7 @@
                         />
                     </form>
                 </li>
+                {% endif %}
             {% endif %}
             <li>
                 {% if not voted %}