from flask import redirect, url_for, request, flash from flask_login import login_required, current_user from app import app, db from app.models.notification import Notification from app.utils.render import render @app.route('/notifications', methods=['GET']) @login_required def list_notifications(): notifications = current_user.notifications return render('account/notifications.html', notifications=notifications) @app.route('/notifications/delete/', methods=['GET']) @login_required def delete_notification(id=None): if type(id) == int: notification = Notification.query.get(id) if notification: # Only current user or admin can delete notifications if notification.owner_id == current_user.id: db.session.delete(notification) db.session.commit() return redirect(url_for('list_notifications')) elif 'delete_notification' in current_user.privs: db.session.delete(notification) db.session.commit() # TODO: change this redirection return redirect(url_for('list_notifications')) else: abort(403) abort(404) elif id == "all": for n in current_user.notifications: db.session.delete(n) db.session.commit() return redirect(url_for('list_notifications')) # TODO: add something to allow an admin to delete all notifs for a user # with a GET parameter else: abort(404)