[Fix] Resolve 500 FieldError in DeviceLocationView #1110

[stktyagi]

Adding organization_lookup = 'organization__in' to the view forces it to use the correct organization field and prevents the crash.

Fixes #1110

Checklist

• I have read the OpenWISP Contributing Guidelines.
• I have manually tested the changes proposed in this pull request.
• I have written new test cases for new code and/or updated existing tests for changes to existing code.
• I have updated the documentation.

Reference to Existing Issue

Closes #1110

Description of Changes

The permission mixin was incorrectly using the child's organization path (content_object__organization) to filter the parent Device including organization_lookup = 'organization__in' to the view fixes it.

[coveralls]

coverage: 98.641%. remained the same
when pulling 058b80b on issues/1110-crash-without-superuser-permission
into 1ee8c25 on master.

[nemesifier]

We need a test which replicates the bug and fails without the patch, otherwise another contributor may inadvertently break this again in the future.

[coderabbitai]

📝 Walkthrough

Walkthrough

This pull request addresses a crash occurring when non-superuser accounts access the device location API endpoint. The fix adds an organization_lookup = "organization__in" attribute to the DeviceLocationView class, which explicitly defines the organization filtering path for permission checks. A corresponding test verifies that users from a different organization receive a proper 404 response instead of a server error.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~12 minutes

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description check	✅ Passed	The PR description follows the template structure, includes the issue reference (#1110), describes changes clearly, and confirms testing and code review checklist completion.
Linked Issues check	✅ Passed	The code changes directly address issue #1110 objectives: adding organization_lookup prevents the FieldError crash by using correct organization field, and new test verifies proper 404 response instead of 500 error.
Out of Scope Changes check	✅ Passed	All changes are directly scoped to fixing issue #1110: the organization_lookup attribute targets the root cause, and the test reproduces the exact failure scenario described.
Title check	✅ Passed	The title accurately describes the main fix: resolving a 500 FieldError in DeviceLocationView, which is the primary change demonstrated by both the code modification and test addition.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[nemesifier]

Thanks @stktyagi 👍