DEFIVELO-221 Fix season access for helpers

defivelo · Jul 8, 2021 · 9c83480 · 9c83480
1 parent b076c6a
commit 9c83480
Show file tree

Hide file tree

Showing 3 changed files with 11 additions and 3 deletions.
diff --git a/apps/challenge/models/season.py b/apps/challenge/models/season.py
@@ -136,6 +136,10 @@ def staff_can_update_availability(self):
     def staff_can_see_planning(self):
         return self.state == DV_SEASON_STATE_RUNNING
 
+    @cached_property
+    def staff_can_see(self):
+        return self.state == DV_SEASON_STATE_RUNNING
+
     @property
     def can_set_state_open(self):
         return self.state == DV_SEASON_STATE_PLANNING
@@ -257,8 +261,7 @@ def unprivileged_user_can_see(self, user):
         # All users selected in season can see all of this season's sessions
         # Coordinators can always consult.
         return (
-            self.state == DV_SEASON_STATE_RUNNING
-            and self.all_helpers_qs.filter(id=user.id).exists()
+            self.staff_can_see and self.all_helpers_qs.filter(id=user.id).exists()
         ) or self.all_coordinator_qs.filter(id=user.id).exists()
 
     def get_absolute_url(self):

diff --git a/apps/challenge/templates/challenge/season_list.html b/apps/challenge/templates/challenge/season_list.html
@@ -38,7 +38,7 @@ <h1>{% blocktrans with year=year season=dv_season|season_verb %}{{ season }} {{
       <tr class="{{ season.state_class }}">
         <td>{{ season.state_icon }}</td>
         <td>
-          {% if user|can:'challenge_season_crud' and user|anyofusercantons:season.cantons or user == season.leader or season.staff_can_see_planning or user in season.all_coordinator_qs %}
+          {% if user|can:'challenge_season_crud' and user|anyofusercantons:season.cantons or user == season.leader or user|unprivileged_user_can_see:season or user in season.all_coordinator_qs %}
             <a href="{% url 'season-detail' pk=season.pk %}" title="{% trans "Liste des sessions" %}">
           {% elif season.staff_can_update_availability and user.profile.is_paid_staff %}
             <a href="{% url 'season-availabilities-update' pk=season.pk helperpk=request.user.pk %}"

diff --git a/defivelo/templatetags/dv_filters.py b/defivelo/templatetags/dv_filters.py
@@ -493,6 +493,11 @@ def anyofusercantons(user, cantons):
         return
 
 
+@register.filter
+def unprivileged_user_can_see(user, season):
+    return season.unprivileged_user_can_see(user)
+
+
 @register.filter
 def inusercantons(user, canton):
     if has_permission(user, "cantons_all"):