diff --git a/services/requirement_service.py b/services/requirement_service.py index 6b2b21c5aac688a5ec519c879c0eced95e9e89e5..84e4505975bccaef8ed993eff13988b91cff8637 100644 --- a/services/requirement_service.py +++ b/services/requirement_service.py @@ -32,13 +32,13 @@ async def create_requirement(data, owner): return result.to_dict(), True -async def get_requirement_by_id(req_id, person): +async def get_requirement_by_id(req_id, user): rq = await Requirement.query_dict_one(Requirement.id == req_id) if not rq: return ERROR_NO_REQUIREMENT_PERMISSION, False person_list = rq['assignee'].split() person_list.append(rq['owner']) - if person not in person_list: + if user['user_name'] not in person_list or user['role'] == User_Role.JUNIOR.value: return ERROR_NO_REQUIREMENT_PERMISSION, False return rq, True diff --git a/views/requirement_view.py b/views/requirement_view.py index 52c26a9b15622cabf93e2021203a21088f1cccee..ff1622b8bdc45dd76b950978df8f167bfab5da15 100644 --- a/views/requirement_view.py +++ b/views/requirement_view.py @@ -29,7 +29,7 @@ async def query(request, user_infos): @bp.get('/') @login_auth async def get_requirement(_, req_id, user_infos): - result, ok = await get_requirement_by_id(req_id, user_infos['user_name']) + result, ok = await get_requirement_by_id(req_id, user_infos) if not ok: return rsp(code=500, msg=result) return rsp(data=result)