manager: allow admin to cancel booking despite no cancel_callback_url (#54060)

chrono/manager/templates/chrono/manager_confirm_booking_cancellation.html

@@ -8,16 +8,26 @@
 {% block content %}
 <form method="post">
   {% if object.backoffice_url and not object.cancel_callback_url %}
+  {% if not user.is_staff %}
   <p>{% trans "This booking has no callback url configured, cancellation must be handled from corresponding form." %}</p>
   <p><a href="{{ object.backoffice_url }}">{% trans "Open form" %}</a></p>
   {% else %}
-
-  {% csrf_token %}
+  <div class="warningnotice">
+  <p>{% trans "This booking has no callback url configured, cancellation should be handled from corresponding form in order to garantee a coherent situation." %}</p>
+  </div>
+  <p><a href="{{ object.backoffice_url }}">{% trans "Open form" %}</a></p>
+  <p>{% trans "However, since you are an administrator, you can choose to cancel it anyway." %}</p>
+  {% endif %}
+  {% else %}
   <p>
   {% blocktrans trimmed with booking=booking.events_display %}
   Are you sure you want to cancel booking "{{ booking }}"?
   {% endblocktrans %}
   </p>
+  {% endif %}
+
+  {% if not object.backoffice_url or object.cancel_callback_url or user.is_staff %}
+  {% csrf_token %}
   <input type="hidden" name="next" value="{% firstof request.POST.next request.GET.next %}">
   {{ form.as_p }}
   <div class="buttons">

tests/manager/test_all.py

@@ -4102,8 +4102,8 @@ def test_duplicate_agenda(app, admin_user):
     assert 'hop' in resp.text
 
 
-def test_booking_cancellation_meetings_agenda(app, admin_user, manager_user, api_user):
-    agenda = Agenda.objects.create(label='Passeports', kind='meetings')
+def test_booking_cancellation_meetings_agenda(app, admin_user, manager_user, managers_group, api_user):
+    agenda = Agenda.objects.create(label='Passeports', kind='meetings', view_role=managers_group)
     desk = Desk.objects.create(agenda=agenda, label='Desk A')
     meetingtype = MeetingType(agenda=agenda, label='passeport', duration=20)
     meetingtype.save()
@@ -4120,11 +4120,28 @@ def test_booking_cancellation_meetings_agenda(app, admin_user, manager_user, api
     booking_url = bookings_resp.json['data'][0]['api']['fillslot_url']
     booking_json = app.post_json(booking_url, params={'backoffice_url': 'http://example.org/'}).json
 
-    app.reset()
-    login(app)
     booking = Booking.objects.get(pk=booking_json['booking_id'])
     date = booking.event.start_datetime
     month_view_url = '/manage/agendas/%s/%d/%d/' % (agenda.id, date.year, date.month)
+
+    app.reset()
+    login(app, username='admin', password='admin')
+    resp = app.get(month_view_url)
+    assert len(resp.pyquery.find('div.booking a.cancel')) == 1  # cancel button is shown
+
+    resp = resp.click('Cancel')
+    # no callback url was provided at booking, warn user but allow cancellation as they are admin
+    assert 'no callback url' in resp.text
+    assert 'Proceed with cancellation' in resp.text
+
+    resp = resp.form.submit()
+    booking.refresh_from_db()
+    assert booking.cancellation_datetime
+
+    app.reset()
+    booking.cancellation_datetime = None
+    booking.save()
+    login(app, username='manager', password='manager')
     resp = app.get(month_view_url)
     assert len(resp.pyquery.find('div.booking a.cancel')) == 1  # cancel button is shown