try

app/applicationlayer/cms/allowed_company/views.py

@@ -39,7 +39,7 @@ class AllowedCompanyViewSet(viewsets.ModelViewSet):
 
         if page is not None:
             serializer = self.get_serializer(page, many=True)
-
+            
             message = status_message_response(
                 200,
                 'success',

app/applicationlayer/cms/template/header/serializers.py

@@ -22,6 +22,7 @@ class ChangeRequestTemplatesSerializer(
     def to_representation(self, instance):
         ret = super().to_representation(instance)
         try:
+            # to edit
             requested_to_user_object = {
                 "id": instance.requested_to_user.id,
                 "name": instance.requested_to_user.name,
@@ -87,7 +88,10 @@ class ChangeRequestTemplatesSerializerList(
 
     def to_representation(self, instance):
         ret = super().to_representation(instance)
+        
         try:
+            current_user = self.context['request'].user.code
+            
             ret['company'] = instance.requested_to_company.name
             ret['department'] = instance.requested_to_department.name
             ret['point_of_contact'] = instance.requested_to_user.name
@@ -96,18 +100,21 @@ class ChangeRequestTemplatesSerializerList(
                 template_no=instance.template_no
             )
 
-
             can_delete = ''
+            owned_template = ''
 
+            if instance.created_by_user.code == current_user:
+                owned_template = True
+            else:
+                owned_template = False
+             
             if child.count() > 0:
-
                 can_delete = False
-
             else:
-
                 can_delete = True
 
             ret['can_delete'] = can_delete
+            ret['owned_template'] = owned_template
 
             return ret
         except Exception as e:

app/applicationlayer/cms/template/header/views.py

@@ -21,7 +21,8 @@ from app.applicationlayer.cms.utils_cr import (
 )
 
 from app.businesslayer.changerequest.change_request_template import (
-    tmp_add_edit_delete
+    tmp_add_edit_delete,
+    list_by_dept_privilege
 )
 from app.applicationlayer.cms.template.approver.serializers import ChangeRequestTemplateApproversSerializer
 from app.applicationlayer.cms.template.stakeholder.serializers import ChangeRequestTemplateStakeHoldersSerializer
@@ -38,8 +39,7 @@ from django_filters.rest_framework import DjangoFilterBackend
 
 
 class ChangeRequestTemplatesViewset(viewsets.ModelViewSet):
-
-    # hello world
+    
     # queryset = models.ChangeRequestTemplateHeader.objects.all()
     queryset = models.ChangeRequestTemplateHeader.objects.select_related(
         'created_by_user', 'created_by_department'
@@ -68,12 +68,13 @@ class ChangeRequestTemplatesViewset(viewsets.ModelViewSet):
     )
 
     def list(self, request, *args, **kwargs):
-        queryset = self.filter_queryset(self.get_queryset())
-        queryset = queryset.filter(created_by_user=request.user.code,
-                                   is_active=True)
         
         self.serializer_class = ChangeRequestTemplatesSerializerList
-
+        id_number = self.request.user.code
+        self.queryset = list_by_dept_privilege(id_number)
+        
+        queryset = self.filter_queryset(self.queryset)
+        
         page = self.paginate_queryset(queryset)
 
         if page is not None:
@@ -82,7 +83,7 @@ class ChangeRequestTemplatesViewset(viewsets.ModelViewSet):
             message = status_message_response(
                 200,
                 'success',
-                'List of Templates found',
+                'List of Change Request Template found',
                 serializer.data
             )
 

app/applicationlayer/management/account/serializer.py

@@ -26,7 +26,7 @@ class UserManagementRetreiveSerializer(serializers.ModelSerializer):
     company = serializers.SerializerMethodField()
     create_form = serializers.SerializerMethodField()
     create_template = serializers.SerializerMethodField()
-
+    
     class Meta:
         model = User
         fields = (

app/businesslayer/changerequest/change_request_template.py

@@ -218,3 +218,25 @@ def validation_vendor_unique_level(approvers):
                     if not approver['delegation'] == 'DELEGATION-20191119-0000002':
                         validate = approver['level']
     return validate
+
+
+def list_by_dept_privilege(user_id_number):
+    try:
+        
+        priviledgeCrs = models.AllowedCompany.objects.filter(
+            Q(id_number=user_id_number) &
+            Q(view_all_change_request_template=True)
+        ).values('group_pivots')
+        
+        return_queryset = models.ChangeRequestTemplateHeader.objects.filter(
+            Q(is_active=True) &
+            (Q(created_by_user=user_id_number) |
+                Q(created_by_department__in=priviledgeCrs))
+        )
+
+        return return_queryset
+
+    except Exception as e:
+        
+        return_queryset = None
+        return return_queryset

app/entities/migrations/0002_allowedcompany_view_all_change_request_template.py

+# Generated by Django 2.2 on 2020-02-27 13:51
+
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('entities', '0001_initial'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='allowedcompany',
+            name='view_all_change_request_template',
+            field=models.BooleanField(default=True),
+        ),
+    ]

app/entities/models.py

@@ -1102,6 +1102,7 @@ class AllowedCompany(models.Model):
     create_change_request_template = models.BooleanField(default=True)
     view_all_change_request = models.BooleanField(default=True)
     approve_cr = models.BooleanField(default=False)
+    view_all_change_request_template = models.BooleanField(default=True)
     created_at = models.DateTimeField(auto_now_add=True)
     deleted_at = models.DateTimeField(null=True, blank=True)
     

config/settings/base.py

@@ -26,7 +26,7 @@ BASE_DIR = os.path.dirname(
 SECRET_KEY = 'w!dkk7gc*dk#4!6ow3s1wc32%_yp$=osgybm=n0vw6k1j^sqo&'
 
 # SECURITY WARNING: don't run with debug turned on in production!
-DEBUG = False
+DEBUG = True
 
 ALLOWED_HOSTS = ['*']
 CORS_ORIGIN_ALLOW_ALL = True