From e4bc7b03ce5d3d5f792f9746f5c90a26a324236f Mon Sep 17 00:00:00 2001
From: "Petter H. Juliussen" <petter.juliussen@origo.oslo.kommune.no>
Date: Tue, 21 Nov 2023 09:46:58 +0100
Subject: [PATCH] Filter items in admin panel depending on admin level

---
 CHANGELOG.md                              |  2 +
 src/views/Admin/CreateDepartment.vue      | 10 +++-
 src/views/Admin/CreateProduct.vue         | 10 +++-
 src/views/Admin/components/AdminItems.vue | 56 ++++++++++++-----------
 4 files changed, 47 insertions(+), 31 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 122c3819e..206111ed7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -43,6 +43,8 @@ All notable changes to this project will be documented in this file. The format
 - The edit button for key result values is now only visible to users with the
   appropriate permissions.
 - Fixed overlapping dates on the x-axis of some line plots on small screens.
+- Organizations, departments, and products in the admin panel are now filtered
+  based on the admin level of the current user.
 
 ### Security
 
diff --git a/src/views/Admin/CreateDepartment.vue b/src/views/Admin/CreateDepartment.vue
index e30ca3683..6759332ca 100644
--- a/src/views/Admin/CreateDepartment.vue
+++ b/src/views/Admin/CreateDepartment.vue
@@ -30,7 +30,7 @@
           :label="$t('admin.department.parentOrganisation')"
           select-label="name"
           rules="required"
-          :select-options="organizations"
+          :select-options="organizationOptions"
           data-cy="dep-parentOrg"
         />
 
@@ -86,7 +86,13 @@ export default {
   }),
 
   computed: {
-    ...mapState(['organizations', 'users']),
+    ...mapState(['organizations', 'users', 'user']),
+
+    organizationOptions() {
+      return this.user.superAdmin
+        ? this.organizations
+        : this.organizations.filter((o) => this.user.admin.includes(o.id));
+    },
   },
 
   methods: {
diff --git a/src/views/Admin/CreateProduct.vue b/src/views/Admin/CreateProduct.vue
index 0d10f31cb..42566a808 100644
--- a/src/views/Admin/CreateProduct.vue
+++ b/src/views/Admin/CreateProduct.vue
@@ -28,7 +28,7 @@
           :label="$t('admin.product.parentDepartment')"
           select-label="name"
           rules="required"
-          :select-options="departments"
+          :select-options="departmentOptions"
         />
 
         <div class="pkt-form-group">
@@ -82,7 +82,13 @@ export default {
   }),
 
   computed: {
-    ...mapState(['departments', 'users']),
+    ...mapState(['departments', 'users', 'user']),
+
+    departmentOptions() {
+      return this.user.superAdmin
+        ? this.departments
+        : this.departments.filter((d) => this.user.admin.includes(d.organization.id));
+    },
   },
 
   methods: {
diff --git a/src/views/Admin/components/AdminItems.vue b/src/views/Admin/components/AdminItems.vue
index fac6c8167..8b9fecc75 100644
--- a/src/views/Admin/components/AdminItems.vue
+++ b/src/views/Admin/components/AdminItems.vue
@@ -171,37 +171,22 @@ export default {
   },
 
   watch: {
-    showArchived: {
+    user: {
       immediate: true,
-      handler() {
-        this.$bind(
-          'organizations',
-          db
-            .collection('organizations')
-            .where('archived', 'in', [false, this.showArchived])
-            .orderBy('slug')
-        );
-        this.$bind(
-          'departments',
-          db
-            .collection('departments')
-            .where('archived', 'in', [false, this.showArchived])
-            .orderBy('slug')
-        );
-        this.$bind(
-          'products',
-          db
-            .collection('products')
-            .where('archived', 'in', [false, this.showArchived])
-            .orderBy('slug')
-        );
-      },
+      handler: 'bindItems',
+    },
+
+    showArchived: {
+      immediate: false,
+      handler: 'bindItems',
     },
 
     organizations: {
       immediate: true,
       handler() {
-        this.filteredOrgs = this.organizations;
+        this.filteredOrgs = this.user.superAdmin
+          ? this.organizations
+          : this.organizations.filter((o) => this.user.admin.includes(o.id));
         this.fuseOrgs = new Fuse(this.filteredOrgs, fuseSettings);
       },
     },
@@ -209,7 +194,9 @@ export default {
     departments: {
       immediate: true,
       handler() {
-        this.filteredDeps = this.departments;
+        this.filteredDeps = this.user.superAdmin
+          ? this.departments
+          : this.departments.filter((d) => this.user.admin.includes(d.organization.id));
         this.fuseDeps = new Fuse(this.filteredDeps, fuseSettings);
       },
     },
@@ -217,7 +204,9 @@ export default {
     products: {
       immediate: true,
       handler() {
-        this.filteredProds = this.products;
+        this.filteredProds = this.user.superAdmin
+          ? this.products
+          : this.products.filter((p) => this.user.admin.includes(p.organization.id));
         this.fuseProds = new Fuse(this.filteredProds, fuseSettings);
       },
     },
@@ -248,6 +237,19 @@ export default {
   },
 
   methods: {
+    bindItems() {
+      for (const collection of ['organizations', 'departments', 'products']) {
+        this.$bind(
+          collection,
+          db
+            .collection(collection)
+            .where('archived', 'in', [false, this.showArchived])
+            .orderBy('slug'),
+          { wait: true }
+        );
+      }
+    },
+
     itemLink(slug) {
       return {
         name: 'ItemAbout',