Merge pull request #252

fix: duplicate totals when account is shared with owner & prevent SharedObject from being shared with owner

app/apps/common/forms.py

@@ -2,6 +2,7 @@ from crispy_forms.bootstrap import FormActions
 from django import forms
 from django.contrib.auth import get_user_model
 from django.utils.translation import gettext_lazy as _
+from django.core.exceptions import ValidationError
 from crispy_forms.helper import FormHelper
 from crispy_forms.layout import Layout, Field, Submit, Div, HTML
 
@@ -81,6 +82,23 @@ class SharedObjectForm(forms.Form):
             ),
         )
 
+    def clean(self):
+        cleaned_data = super().clean()
+        owner = cleaned_data.get("owner")
+        shared_with_users = cleaned_data.get("shared_with_users", [])
+
+        # Raise validation error if owner is in shared_with_users
+        if owner and owner in shared_with_users:
+            self.add_error(
+                "shared_with_users",
+                ValidationError(
+                    _("You cannot share this item with its owner."),
+                    code="invalid_share",
+                ),
+            )
+
+        return cleaned_data
+
     def save(self):
         instance = self.instance
 

app/apps/transactions/models.py

@@ -118,13 +118,20 @@ class SoftDeleteManager(models.Manager):
         qs = SoftDeleteQuerySet(self.model, using=self._db)
         user = get_current_user()
         if user and not user.is_anonymous:
-            return qs.filter(
+            account_ids = (
-                Q(account__visibility="public")
+                qs.filter(
-                | Q(account__owner=user)
+                    Q(account__visibility="public")
-                | Q(account__shared_with=user)
+                    | Q(account__owner=user)
-                | Q(account__visibility="private", account__owner=None),
+                    | Q(account__shared_with=user)
-                deleted=False,
+                    | Q(account__visibility="private", account__owner=None),
-            ).distinct()
+                    deleted=False,
+                )
+                .values_list("account__id", flat=True)
+                .distinct()
+            )
+
+            return qs.filter(account_id__in=account_ids, deleted=False)
+
         else:
             return qs.filter(
                 deleted=False,