Add backend support for ownership requests

backend/clubs/admin.py

@@ -37,6 +37,7 @@
     MembershipRequest,
     Note,
     NoteTag,
+    OwnershipRequest,
     Profile,
     QuestionAnswer,
     RecurringEvent,
@@ -281,6 +282,27 @@ def is_member(self, obj):
     is_member.boolean = True
 
 
+class OwnershipRequestAdmin(admin.ModelAdmin):
+    search_fields = (
+        "person__username",
+        "person__email",
+        "club__name",
+        "club__pk",
+        "created_at",
+    )
+    list_display = ("person", "club", "email", "withdrew", "created_at")
+    list_filter = ("withdrew",)
+
+    def person(self, obj):
+        return obj.person.username
+
+    def club(self, obj):
+        return obj.club.name
+
+    def email(self, obj):
+        return obj.person.email
+
+
 class MembershipAdmin(admin.ModelAdmin):
     search_fields = (
         "person__username",
@@ -438,6 +460,7 @@ class ApplicationSubmissionAdmin(admin.ModelAdmin):
 admin.site.register(Major, MajorAdmin)
 admin.site.register(Membership, MembershipAdmin)
 admin.site.register(MembershipInvite, MembershipInviteAdmin)
+admin.site.register(OwnershipRequest, OwnershipRequestAdmin)
 admin.site.register(Profile, ProfileAdmin)
 admin.site.register(QuestionAnswer, QuestionAnswerAdmin)
 admin.site.register(RecurringEvent)

backend/clubs/migrations/0114_ownershiprequest.py

@@ -0,0 +1,41 @@
+# Generated by Django 5.0.4 on 2024-10-06 05:12
+
+import django.db.models.deletion
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("clubs", "0113_badge_message"),
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name="OwnershipRequest",
+            fields=[
+                ("id", models.AutoField(
+                    auto_created=True,
+                    primary_key=True,
+                    serialize=False,
+                    verbose_name="ID"
+                )),
+                ("withdrew", models.BooleanField(default=False)),
+                ("created_at", models.DateTimeField(auto_now_add=True)),
+                ("updated_at", models.DateTimeField(auto_now=True)),
+                ("club", models.ForeignKey(
+                    on_delete=django.db.models.deletion.CASCADE,
+                    to="clubs.club"
+                )),
+                ("person", models.ForeignKey(
+                    on_delete=django.db.models.deletion.CASCADE,
+                    to=settings.AUTH_USER_MODEL
+                )),
+            ],
+            options={
+                "unique_together": {("person", "club")},
+            },
+        ),
+    ]

backend/clubs/migrations/0117_merge_20241015_1652.py

@@ -0,0 +1,14 @@
+# Generated by Django 5.0.4 on 2024-10-15 20:52
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ("clubs", "0114_ownershiprequest"),
+        ("clubs", "0116_alter_club_approved_on_and_more"),
+    ]
+
+    operations = [
+    ]

backend/clubs/models.py

@@ -1122,6 +1122,54 @@ class Meta:
         unique_together = (("person", "club"),)
 
 
+class OwnershipRequest(models.Model):
+    """
+    Used when users request ownership from the owner
+    """
+
+    person = models.ForeignKey(get_user_model(), on_delete=models.CASCADE)
+    club = models.ForeignKey(Club, on_delete=models.CASCADE)
+
+    withdrew = models.BooleanField(default=False)
+
+    created_at = models.DateTimeField(auto_now_add=True)
+    updated_at = models.DateTimeField(auto_now=True)
+
+    def __str__(self):
+        return "<OwnershipRequest: {} for {}, with email {}>".format(
+            self.person.username, self.club.code, self.person.email
+        )
+
+    def send_request(self, request=None):
+        domain = get_domain(request)
+
+        context = {
+            "club_name": self.club.name,
+            "edit_url": "{}/member".format(
+                settings.EDIT_URL.format(domain=domain, club=self.club.code)
+            ),
+            "full_name": self.person.get_full_name(),
+        }
+
+        owner_emails = list(
+            self.club.membership_set.filter(
+                role=Membership.ROLE_OWNER, active=True
+            ).values_list("person__email", flat=True)
+        )
+
+        send_mail_helper(
+            name="ownershiprequest",
+            subject="Ownership Request from {} for {}".format(
+                self.person.get_full_name(), self.club.name
+            ),
+            emails=owner_emails,
+            context=context,
+        )
+
+    class Meta:
+        unique_together = (("person", "club"),)
+
+
 class Advisor(models.Model):
     """
     Represents one faculty advisor or point of contact for a club.

backend/clubs/permissions.py

@@ -437,6 +437,26 @@ def has_permission(self, request, view):
         return membership is not None and membership.role <= Membership.ROLE_OFFICER
 
 
+class OwnershipRequestPermission(permissions.BasePermission):
+    """
+    Only owners can view and modify ownership requests.
+    """
+
+    def has_permission(self, request, view):
+        if not request.user.is_authenticated:
+            return False
+
+        if "club_code" not in view.kwargs:
+            return False
+
+        if request.user.has_perm("clubs.manage_club"):
+            return True
+
+        obj = Club.objects.get(code=view.kwargs["club_code"])
+        membership = find_membership_helper(request.user, obj)
+        return membership is not None and membership.role == Membership.ROLE_OWNER
+
+
 class InvitePermission(permissions.BasePermission):
     """
     Officers and higher can list/delete invitations.

backend/clubs/serializers.py

@@ -42,6 +42,7 @@
     MembershipRequest,
     Note,
     NoteTag,
+    OwnershipRequest,
     Profile,
     QuestionAnswer,
     Report,
@@ -1998,6 +1999,70 @@ class Meta:
         fields = ("club", "club_name", "person")
 
 
+class OwnershipRequestSerializer(serializers.ModelSerializer):
+    """
+    Used by club owners/officers to see who has requested to be owner of the club.
+    """
+
+    person = serializers.HiddenField(default=serializers.CurrentUserDefault())
+    club = serializers.SlugRelatedField(queryset=Club.objects.all(), slug_field="code")
+    name = serializers.SerializerMethodField("get_full_name")
+    username = serializers.CharField(source="person.username", read_only=True)
+    email = serializers.EmailField(source="person.email", read_only=True)
+
+    school = SchoolSerializer(many=True, source="person.profile.school", read_only=True)
+    major = MajorSerializer(many=True, source="person.profile.major", read_only=True)
+    graduation_year = serializers.IntegerField(
+        source="person.profile.graduation_year", read_only=True
+    )
+
+    def get_full_name(self, obj):
+        return obj.person.get_full_name()
+
+    class Meta:
+        model = OwnershipRequest
+        fields = (
+            "club",
+            "created_at",
+            "email",
+            "graduation_year",
+            "major",
+            "name",
+            "person",
+            "school",
+            "username",
+        )
+        validators = [
+            validators.UniqueTogetherValidator(
+                queryset=OwnershipRequest.objects.all(), fields=["club", "person"]
+            )
+        ]
+
+
+class UserOwnershipRequestSerializer(serializers.ModelSerializer):
+    """
+    Used by the users to return the clubs that the user has sent OwnershipRequest to.
+    """
+
+    person = serializers.HiddenField(default=serializers.CurrentUserDefault())
+    club = serializers.SlugRelatedField(queryset=Club.objects.all(), slug_field="code")
+    club_name = serializers.CharField(source="club.name", read_only=True)
+
+    def create(self, validated_data):
+        """
+        Send an email when a ownership request is created.
+        """
+        obj = super().create(validated_data)
+
+        obj.send_request(self.context["request"])
+
+        return obj
+
+    class Meta:
+        model = OwnershipRequest
+        fields = ("club", "club_name", "person")
+
+
 class MinimalUserProfileSerializer(serializers.ModelSerializer):
     """
     A profile serializer used for the list view of all users.

backend/clubs/urls.py

@@ -34,6 +34,9 @@
     MemberViewSet,
     NoteViewSet,
     OptionListView,
+    OwnershipRequestOwnerViewSet,
+    OwnershipRequestSuperuserAPIView,
+    OwnershipRequestViewSet,
     QuestionAnswerViewSet,
     ReportViewSet,
     SchoolViewSet,
@@ -70,6 +73,9 @@
 router.register(r"searches", SearchQueryViewSet, basename="searches")
 router.register(r"memberships", MembershipViewSet, basename="members")
 router.register(r"requests", MembershipRequestViewSet, basename="requests")
+router.register(
+    r"ownershiprequests", OwnershipRequestViewSet, basename="ownershiprequests"
+)
 router.register(r"tickets", TicketViewSet, basename="tickets")
 
 router.register(r"schools", SchoolViewSet, basename="schools")
@@ -106,6 +112,11 @@
     MembershipRequestOwnerViewSet,
     basename="club-membership-requests",
 )
+clubs_router.register(
+    r"ownershiprequests",
+    OwnershipRequestOwnerViewSet,
+    basename="club-ownership-requests",
+)
 clubs_router.register(r"advisors", AdvisorViewSet, basename="club-advisors")
 clubs_router.register(
     r"applications", ClubApplicationViewSet, basename="club-applications"
@@ -163,6 +174,11 @@
     path(r"emailpreview/", email_preview, name="email-preview"),
     path(r"scripts/", ScriptExecutionView.as_view(), name="scripts"),
     path(r"options/", OptionListView.as_view(), name="options"),
+    path(
+        r"ownershiprequestsadmin/",
+        OwnershipRequestSuperuserAPIView.as_view(),
+        name="ownershiprequestsadmin",
+    ),
     path(r"social/", include("social_django.urls", namespace="social")),
     path(
         r"webhook/meeting/",