feat: multi tenancy support

app/apps/accounts/views/account_groups.py

@@ -8,6 +8,8 @@ from django.views.decorators.http import require_http_methods
 from apps.accounts.forms import AccountGroupForm
 from apps.accounts.models import AccountGroup
 from apps.common.decorators.htmx import only_htmx
+from apps.common.models import SharedObject
+from apps.common.forms import SharedObjectForm
 
 
 @login_required
@@ -63,6 +65,16 @@ def account_group_add(request, **kwargs):
 def account_group_edit(request, pk):
     account_group = get_object_or_404(AccountGroup, id=pk)
 
+    if account_group.owner and account_group.owner != request.user:
+        messages.error(request, _("Only the owner can edit this"))
+
+        return HttpResponse(
+            status=204,
+            headers={
+                "HX-Trigger": "updated, hide_offcanvas",
+            },
+        )
+
     if request.method == "POST":
         form = AccountGroupForm(request.POST, instance=account_group)
         if form.is_valid():
@@ -91,9 +103,15 @@ def account_group_edit(request, pk):
 def account_group_delete(request, pk):
     account_group = get_object_or_404(AccountGroup, id=pk)
 
-    account_group.delete()
-
-    messages.success(request, _("Account Group deleted successfully"))
+    if (
+        account_group.owner != request.user
+        and request.user in account_group.shared_with.all()
+    ):
+        account_group.shared_with.remove(request.user)
+        messages.success(request, _("Item no longer shared with you"))
+    else:
+        account_group.delete()
+        messages.success(request, _("Account Group deleted successfully"))
 
     return HttpResponse(
         status=204,
@@ -101,3 +119,62 @@ def account_group_delete(request, pk):
             "HX-Trigger": "updated, hide_offcanvas",
         },
     )
+
+
+@only_htmx
+@login_required
+@require_http_methods(["GET"])
+def account_group_take_ownership(request, pk):
+    account_group = get_object_or_404(AccountGroup, id=pk)
+
+    if not account_group.owner:
+        account_group.owner = request.user
+        account_group.visibility = SharedObject.Visibility.private
+        account_group.save()
+
+        messages.success(request, _("Ownership taken successfully"))
+
+    return HttpResponse(
+        status=204,
+        headers={
+            "HX-Trigger": "updated, hide_offcanvas",
+        },
+    )
+
+
+@only_htmx
+@login_required
+@require_http_methods(["GET", "POST"])
+def account_share(request, pk):
+    obj = get_object_or_404(AccountGroup, id=pk)
+
+    if obj.owner and obj.owner != request.user:
+        messages.error(request, _("Only the owner can edit this"))
+
+        return HttpResponse(
+            status=204,
+            headers={
+                "HX-Trigger": "updated, hide_offcanvas",
+            },
+        )
+
+    if request.method == "POST":
+        form = SharedObjectForm(request.POST, instance=obj, user=request.user)
+        if form.is_valid():
+            form.save()
+            messages.success(request, _("Configuration saved successfully"))
+
+            return HttpResponse(
+                status=204,
+                headers={
+                    "HX-Trigger": "updated, hide_offcanvas",
+                },
+            )
+    else:
+        form = SharedObjectForm(instance=obj, user=request.user)
+
+    return render(
+        request,
+        "accounts/fragments/share.html",
+        {"form": form, "object": obj},
+    )

app/apps/accounts/views/accounts.py

@@ -8,6 +8,8 @@ from django.views.decorators.http import require_http_methods
 from apps.accounts.forms import AccountForm
 from apps.accounts.models import Account
 from apps.common.decorators.htmx import only_htmx
+from apps.common.models import SharedObject
+from apps.common.forms import SharedObjectForm
 
 
 @login_required
@@ -62,6 +64,15 @@ def account_add(request, **kwargs):
 @require_http_methods(["GET", "POST"])
 def account_edit(request, pk):
     account = get_object_or_404(Account, id=pk)
+    if account.owner and account.owner != request.user:
+        messages.error(request, _("Only the owner can edit this"))
+
+        return HttpResponse(
+            status=204,
+            headers={
+                "HX-Trigger": "updated, hide_offcanvas",
+            },
+        )
 
     if request.method == "POST":
         form = AccountForm(request.POST, instance=account)
@@ -85,15 +96,77 @@ def account_edit(request, pk):
     )
 
 
+@only_htmx
+@login_required
+@require_http_methods(["GET", "POST"])
+def account_share(request, pk):
+    obj = get_object_or_404(Account, id=pk)
+
+    if obj.owner and obj.owner != request.user:
+        messages.error(request, _("Only the owner can edit this"))
+
+        return HttpResponse(
+            status=204,
+            headers={
+                "HX-Trigger": "updated, hide_offcanvas",
+            },
+        )
+
+    if request.method == "POST":
+        form = SharedObjectForm(request.POST, instance=obj, user=request.user)
+        if form.is_valid():
+            form.save()
+            messages.success(request, _("Configuration saved successfully"))
+
+            return HttpResponse(
+                status=204,
+                headers={
+                    "HX-Trigger": "updated, hide_offcanvas",
+                },
+            )
+    else:
+        form = SharedObjectForm(instance=obj, user=request.user)
+
+    return render(
+        request,
+        "accounts/fragments/share.html",
+        {"form": form, "object": obj},
+    )
+
+
 @only_htmx
 @login_required
 @require_http_methods(["DELETE"])
 def account_delete(request, pk):
     account = get_object_or_404(Account, id=pk)
 
-    account.delete()
-
-    messages.success(request, _("Account deleted successfully"))
+    if account.owner != request.user and request.user in account.shared_with.all():
+        account.shared_with.remove(request.user)
+        messages.success(request, _("Item no longer shared with you"))
+    else:
+        account.delete()
+        messages.success(request, _("Account deleted successfully"))
+
+    return HttpResponse(
+        status=204,
+        headers={
+            "HX-Trigger": "updated, hide_offcanvas",
+        },
+    )
+
+
+@only_htmx
+@login_required
+@require_http_methods(["GET"])
+def account_take_ownership(request, pk):
+    account = get_object_or_404(Account, id=pk)
+
+    if not account.owner:
+        account.owner = request.user
+        account.visibility = SharedObject.Visibility.private
+        account.save()
+
+        messages.success(request, _("Ownership taken successfully"))
 
     return HttpResponse(
         status=204,

app/apps/accounts/views/balance.py

@@ -38,9 +38,9 @@ def account_reconciliation(request):
             "prefix": account.currency.prefix,
             "current_balance": get_account_balance(account),
         }
-        for account in Account.objects.filter(is_archived=False).select_related(
-            "currency", "group"
-        )
+        for account in Account.objects.filter(is_archived=False)
+        .select_related("currency", "group")
+        .order_by("group", "name")
     ]
 
     if request.method == "POST":