:bug: (backend) `NestedOrderCourseViewset` should only return orders where user has organization access

openfun / joanie

👛 A headless ERP for education to manage course enrollment/subscription, payment and certificates delivery.

MIT License

20 stars 2 forks source link

Closed jonathanreveille closed 2 months ago

jonathanreveille commented 3 months ago

This PR solves this issue

The issue is that the requesting user would get all the results of orders instead of having only the orders where he has an organization access.

[x] Override def get_queryset of the viewset NestedOrderCourseViewSet
[x] Update tests and add test showing that organization access is required to get results