[nhoening]

Description

There was a UI bug for consultants who aren’t admins of their own organisation.
They could not see the “Create asset” button on a client asset.
The reason: FlexMeasures checks whether they can create assets in their own organisation, instead of under the client’s parent asset.

• Show clients' create asset button to consultants, by using the right permission
• Added changelog item in documentation/changelog.rst

How to test

• Be a user with consultant role, but not an admin
• Go to a client account. You can add a top-level asset, but then (before this PR) no button to add a child asset will be shown. After this PR, it will be shown.

[read-the-docs-community]

Documentation build overview

📚 flexmeasures | 🛠️ Build #35758807 | 📁 Comparing d57bf99 against latest (055d54d)

  🔍 Preview build  

2 files changed

± changelog.html
± api/v3_0.html

[BelhsanHmida]

Tested locally: the fix works, a non-admin consultant now sees "Create asset" on a client asset and can create the child.

But plain members now see the button too (test), while /assets/new and /assets/create still check the organisation, so clicking it gives them a 403. If that's intended, they don't get a clear error: the browser shows raw JSON ("You cannot be authorized for this content or functionality.", "INVALID_SENDER"), since unauthorized_handler answers in JSON when there's no Content-Type, which is the case for any link click.

If it's not intended, gate the button on user_can_create_assets(account=asset.owner), the same check the page uses, and fix the test and changelog wording. Or, if members should create children (the API already allows it), make the GET and POST check user_can_create_children(parent_asset) / check_access(parent_asset, "edit-assets") when a parent is given, like the API does.

[BelhsanHmida]

Tested locally: the fix works, a non-admin consultant now sees "Create asset" on a client asset and can create the child.

But plain members now see the button too (test), while /assets/new and /assets/create still check the organisation, so clicking it gives them a 403. If that's intended, they don't get a clear error: the browser shows raw JSON ("You cannot be authorized for this content or functionality.", "INVALID_SENDER"), since unauthorized_handler answers in JSON when there's no Content-Type, which is the case for any link click.

If it's not intended, gate the button on user_can_create_assets(account=asset.owner), the same check the page uses, and fix the test and changelog wording. Or, if members should create children (the API already allows it), make the GET and POST check user_can_create_children(parent_asset) / check_access(parent_asset, "edit-assets") when a parent is given, like the API does.