Convert requirements to a cart-validation

[squidgetx]

From equipment_models/show.html.erb: TODO: Eventually requirements will be handled with special Requests, similar to how extended reservations are handled.

[dgoerger]

This priority is getting bumped because currently if a patron does not meet the requirements to check out an item, and an admin files the reservation on the patron's behalf, the admin receives no warning that the patron is not qualified to check out this given equipment.

Tested on current release-v3.4.

[squidgetx]

CNR; the add to cart button is greyed out if the cart reserver isn't qualified. if you add the item to your cart as a certified admin/checkout and then change the reserver id you can get through. This actually means that anyone with override privileges can checkout required equipment by changing the reserver id to someone who is qualified, adding the item to cart, and then changing the cart reserver back to themselves.

We could make it that the item can still be added to the cart and thus anyone with override priveleges can check out the equipment that has requirements, though I don't know how good of an idea that would be. On the other hand it would also enable patrons to file requests for items they are not certified for, which depending on the use case, could be a good idea.

[orenyk]

I don't think we need to allow patrons to request reservations where the requirements aren't met, at least not remotely. That's a significant enough request that I feel like it should be handled on a case-by-case basis.

[squidgetx]

Ah well the thing is that that is how it is currently implemented in 3.4 and in master. For the most part patrons and checkout people can't add items that require certification to the cart but this is all frontend logic (those items can be added to the cart with some tricky page navigation, no url hacks required). Requirements being a cart reservation means that requirements are relegated to the same status as all other cart reservations.

We could (in the future, not for 3.4 I'm guessing) move this logic from cart reservations to the application_controller update_cart method, though Id on't really relish the idea of making that method more complciated than it is already.

[orenyk]

That's fine. At the moment the only way to perform that tricky navigation is if you're a user who has permissions to override validations (e.g. a checkout person or admin). A regular patron shouldn't be able to add an item to the cart that they don't meet the requirements for unless they start hacking the session, right? That's enough to me, I just meant that a patron sitting at home shouldn't be able to issue a request to override a requirement. Does that make more sense?

[squidgetx]

Yeah. It works out fine for nwo but it does appear to be inconsistent which we should attempt to figure out at some point in the future. If checkout persons/admins are allowed to reserve restricted items for other users, given that they have to fill out the form implemented in #730 , then it doesn't make sense for the items to be inaccessible on the frontend. We could just disable the disabling of the button if the user has the ability to manage reservations, or something.