From 9c83480bf5f37a6d185383dfc00d13e927b40c59 Mon Sep 17 00:00:00 2001
From: Didier 'OdyX' Raboud <didier.raboud@liip.ch>
Date: Wed, 7 Jul 2021 14:27:09 +0200
Subject: [PATCH] DEFIVELO-221 Fix season access for helpers

---
 apps/challenge/models/season.py                     | 7 +++++--
 apps/challenge/templates/challenge/season_list.html | 2 +-
 defivelo/templatetags/dv_filters.py                 | 5 +++++
 3 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/apps/challenge/models/season.py b/apps/challenge/models/season.py
index 0f5a83ca..1312d891 100644
--- a/apps/challenge/models/season.py
+++ b/apps/challenge/models/season.py
@@ -136,6 +136,10 @@ def staff_can_update_availability(self):
     def staff_can_see_planning(self):
         return self.state == DV_SEASON_STATE_RUNNING
 
+    @cached_property
+    def staff_can_see(self):
+        return self.state == DV_SEASON_STATE_RUNNING
+
     @property
     def can_set_state_open(self):
         return self.state == DV_SEASON_STATE_PLANNING
@@ -257,8 +261,7 @@ def unprivileged_user_can_see(self, user):
         # All users selected in season can see all of this season's sessions
         # Coordinators can always consult.
         return (
-            self.state == DV_SEASON_STATE_RUNNING
-            and self.all_helpers_qs.filter(id=user.id).exists()
+            self.staff_can_see and self.all_helpers_qs.filter(id=user.id).exists()
         ) or self.all_coordinator_qs.filter(id=user.id).exists()
 
     def get_absolute_url(self):
diff --git a/apps/challenge/templates/challenge/season_list.html b/apps/challenge/templates/challenge/season_list.html
index d566a348..57d13f14 100644
--- a/apps/challenge/templates/challenge/season_list.html
+++ b/apps/challenge/templates/challenge/season_list.html
@@ -38,7 +38,7 @@ <h1>{% blocktrans with year=year season=dv_season|season_verb %}{{ season }} {{
       <tr class="{{ season.state_class }}">
         <td>{{ season.state_icon }}</td>
         <td>
-          {% if user|can:'challenge_season_crud' and user|anyofusercantons:season.cantons or user == season.leader or season.staff_can_see_planning or user in season.all_coordinator_qs %}
+          {% if user|can:'challenge_season_crud' and user|anyofusercantons:season.cantons or user == season.leader or user|unprivileged_user_can_see:season or user in season.all_coordinator_qs %}
             <a href="{% url 'season-detail' pk=season.pk %}" title="{% trans "Liste des sessions" %}">
           {% elif season.staff_can_update_availability and user.profile.is_paid_staff %}
             <a href="{% url 'season-availabilities-update' pk=season.pk helperpk=request.user.pk %}"
diff --git a/defivelo/templatetags/dv_filters.py b/defivelo/templatetags/dv_filters.py
index 5b3be9c5..8410e50d 100644
--- a/defivelo/templatetags/dv_filters.py
+++ b/defivelo/templatetags/dv_filters.py
@@ -493,6 +493,11 @@ def anyofusercantons(user, cantons):
         return
 
 
+@register.filter
+def unprivileged_user_can_see(user, season):
+    return season.unprivileged_user_can_see(user)
+
+
 @register.filter
 def inusercantons(user, canton):
     if has_permission(user, "cantons_all"):