From b38f888b2b5b6d95b2b352548fd6457e68063023 Mon Sep 17 00:00:00 2001
From: Julio Biason <julioandre@cwi.com.br>
Date: Wed, 9 Apr 2014 14:41:18 -0300
Subject: [PATCH] back relationships in sqlalchemy are BORKED LIKE FUCK

---
 luncho/blueprints/groups.py |  5 +++++
 luncho/server.py            | 10 +++++++---
 tests/group_tests.py        | 35 +++++++++++++++++++++++++++++++++++
 3 files changed, 47 insertions(+), 3 deletions(-)

diff --git a/luncho/blueprints/groups.py b/luncho/blueprints/groups.py
index 0ef17a5..6065a1c 100644
--- a/luncho/blueprints/groups.py
+++ b/luncho/blueprints/groups.py
@@ -454,14 +454,19 @@ def group_add_places(group_id):
 
     not_found = []
     rejected = []
+    LOG.debug('Users in the group: {users}'.format(users=group.users))
     for place_id in request.as_json.get('places', []):
         place = Place.query.get(place_id)
         if not place:
             not_found.append(place_id)
             continue
 
+        LOG.debug('Place {place_id} owner: {owner}'.format(
+            place_id=place_id,
+            owner=place.owner))
         if place.owner not in group.users:
             rejected.append(place_id)
+            continue
 
         group.places.append(place)
     db.session.commit()
diff --git a/luncho/server.py b/luncho/server.py
index 7e6b9be..a86b8ec 100644
--- a/luncho/server.py
+++ b/luncho/server.py
@@ -64,7 +64,7 @@ class User(db.Model):
     created_at = db.Column(db.DateTime, nullable=False)
     groups = db.relationship('Group',
                              secondary=user_groups,
-                             backref=db.backref('users', lazy='dynamic'))
+                             backref=db.backref('users', lazy='select'))
 
     def __init__(self, username, fullname, passhash, token=None,
                  issued_date=None, verified=False):
@@ -92,6 +92,11 @@ class User(db.Model):
                              'issued_date': datetime.date.today().isoformat()})
         return hmac.new(self.created_at.isoformat(), phrase).hexdigest()
 
+    def __repr__(self):
+        return 'User {username}-{fullname}'.format(
+            username=self.username,
+            fullname=self.fullname)
+
 
 class Group(db.Model):
     id = db.Column(db.Integer, primary_key=True)
@@ -99,8 +104,7 @@ class Group(db.Model):
     owner = db.Column(db.String, db.ForeignKey('user.username'))
     places = db.relationship('Place',
                              secondary=group_places,
-                             backref='groups',
-                             lazy='dynamic')
+                             backref=db.backref('groups', lazy='select'))
 
     def __init__(self, name, owner):
         self.name = name
diff --git a/tests/group_tests.py b/tests/group_tests.py
index 4bb97ee..72d9554 100644
--- a/tests/group_tests.py
+++ b/tests/group_tests.py
@@ -442,6 +442,41 @@ class TestPlacesInGroup(LunchoTests):
                        request,
                        token=self.user.token)
         self.assertJsonOk(rv)
+        json = loads(rv.data)
+        self.assertTrue('rejected' in json)
+        self.assertFalse(json['rejected'])  # the list should be empty (False)
+        return
+
+    def test_add_place_of_member(self):
+        """Add a place that belongs to a member of the group."""
+        new_user = self.create_user(name='newuser',
+                                    fullname='new user',
+                                    verified=True)
+        group = self._group()           # group belongs to self.user
+        group.users.append(new_user)
+        place = self._place(new_user)   # place belongs to new_user
+
+        request = {'places': [place.id]}
+        group_id = group.id
+        rv = self.post('/group/{group_id}/places/'.format(group_id=group_id),
+                       request,
+                       token=self.user.token)
+        self.assertJsonOk(rv)
+
+    def test_add_place_of_non_member(self):
+        """Add a place that belongs to seomeone not in the group."""
+        new_user = self.create_user(name='newuser',
+                                    fullname='new user',
+                                    verified=True)
+        group = self._group()           # group belongs to self.user
+        place = self._place(new_user)   # place belongs to new_user
+
+        request = {'places': [place.id]}
+        group_id = group.id
+        rv = self.post('/group/{group_id}/places/'.format(group_id=group_id),
+                       request,
+                       token=self.user.token)
+        self.assertJsonOk(rv)
 
 if __name__ == '__main__':
     unittest.main()