(self, request, organisation_pk, pk)
| 261 | ) |
| 262 | @action(detail=True, methods=["POST"], url_path="remove-users") |
| 263 | def remove_users(self, request, organisation_pk, pk): # type: ignore[no-untyped-def] |
| 264 | group = self.get_object() |
| 265 | user_ids = request.data["user_ids"] |
| 266 | |
| 267 | if ( |
| 268 | isinstance(request.user, FFAdminUser) |
| 269 | and request.user.id in user_ids |
| 270 | and not request.user.is_organisation_admin( |
| 271 | Organisation.objects.get(pk=organisation_pk) |
| 272 | ) |
| 273 | ): |
| 274 | raise PermissionDenied( |
| 275 | "Non-admin users cannot remove themselves from a group." |
| 276 | ) |
| 277 | |
| 278 | group.remove_users_by_id(user_ids) |
| 279 | return Response(UserPermissionGroupSerializerDetail(instance=group).data) |
| 280 | |
| 281 | @action(detail=False, methods=["GET"], url_path="my-groups") |
| 282 | def my_groups(self, request: Request, organisation_pk: int) -> Response: |
nothing calls this directly
no test coverage detected