Revised to allow the viewers to view the account order page.

src/accounting/account/views.py

@@ -169,7 +169,7 @@ def delete_account(account: Account) -> redirect:
 
 
 @bp.get("/bases/<baseAccount:base>", endpoint="order")
-@has_permission(can_edit)
+@has_permission(can_view)
 def show_account_order(base: BaseAccount) -> str:
     """Shows the order of the accounts under a same base account.
 

src/accounting/templates/accounting/account/detail.html

@@ -35,10 +35,12 @@ First written: 2023/1/31
       <i class="fa-solid fa-gear"></i>
       {{ A_("Settings") }}
     </a>
+  {% endif %}
   <a class="btn btn-primary" href="{{ url_for("accounting.account.order", base=obj.base)|append_next }}">
     <i class="fa-solid fa-bars-staggered"></i>
     {{ A_("Order") }}
   </a>
+  {% if can_edit_accounting() %}
     <button class="btn btn-danger" type="button" data-bs-toggle="modal" data-bs-target="#delete-modal">
       <i class="fa-solid fa-trash"></i>
       {{ A_("Delete") }}

src/accounting/templates/accounting/account/order.html

@@ -37,7 +37,7 @@ First written: 2023/2/2
   </a>
 </div>
 
-{% if base.accounts|length > 1 %}
+{% if base.accounts|length > 1 and can_edit_accounting() %}
   <form action="{{ url_for("accounting.account.sort", base=base) }}" method="post">
     <input id="csrf_token" type="hidden" name="csrf_token" value="{{ csrf_token() }}">
     {% if "next" in request.args %}
@@ -69,11 +69,13 @@ First written: 2023/2/2
       </button>
     </div>
   </form>
-{% elif base.accounts|length == 1 %}
+{% elif base.accounts %}
   <ul class="list-group mb-3">
+    {% for account in base.accounts|sort(attribute="no") %}
       <li class="list-group-item">
-      {{ base.accounts[0] }}
+        {{ account }}
       </li>
+    {% endfor %}
   </ul>
 {% else %}
   <p>{{ A_("There is no data.") }}</p>