From f11d20c2f9245632279e8b1f1a01e17448fdb9fd Mon Sep 17 00:00:00 2001
From: Claude Paroz <claude@2xlibre.net>
Date: Thu, 7 Feb 2019 09:24:55 +0100
Subject: [PATCH] =?UTF-8?q?Limite=20autorisation=20de=20commentaire=20aux?=
 =?UTF-8?q?=20pers.=20autoris=C3=A9es?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 ...001_squashed_0024_course_public_length2.py |  4 +--
 .../migrations/0020_teacher_to_user_link.py   | 18 ++++++++++++
 stages/models.py                              | 11 ++++++++
 stages/tests.py                               | 28 +++++++++++++++++--
 stages/views/__init__.py                      |  7 +++++
 templates/student_comment.html                |  2 ++
 6 files changed, 66 insertions(+), 4 deletions(-)
 create mode 100644 stages/migrations/0020_teacher_to_user_link.py

diff --git a/stages/migrations/0001_squashed_0024_course_public_length2.py b/stages/migrations/0001_squashed_0024_course_public_length2.py
index d1fc0c9..9ef9e5b 100644
--- a/stages/migrations/0001_squashed_0024_course_public_length2.py
+++ b/stages/migrations/0001_squashed_0024_course_public_length2.py
@@ -122,9 +122,9 @@ class Migration(migrations.Migration):
                 ('level', models.ForeignKey(on_delete=django.db.models.deletion.PROTECT, to='stages.Level', verbose_name='Niveau')),
             ],
             options={
-                'verbose_name': 'Période de pratique professionnnelle',
-                'verbose_name_plural': 'Périodes de pratique professionnnelle',
                 'ordering': ('-start_date',),
+                'verbose_name': 'Période de pratique professionnelle',
+                'verbose_name_plural': 'Périodes de pratique professionnelle',
             },
         ),
         migrations.CreateModel(
diff --git a/stages/migrations/0020_teacher_to_user_link.py b/stages/migrations/0020_teacher_to_user_link.py
new file mode 100644
index 0000000..f92e0f4
--- /dev/null
+++ b/stages/migrations/0020_teacher_to_user_link.py
@@ -0,0 +1,18 @@
+from django.conf import settings
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+        ('stages', '0019_teacher_ecg_eps'),
+    ]
+
+    operations = [
+        migrations.AddField(
+            model_name='teacher',
+            name='user',
+            field=models.OneToOneField(blank=True, null=True, on_delete=models.deletion.SET_NULL, to=settings.AUTH_USER_MODEL, verbose_name='Compte utilisateur'),
+        ),
+    ]
diff --git a/stages/models.py b/stages/models.py
index 26dad60..de1579f 100644
--- a/stages/models.py
+++ b/stages/models.py
@@ -1,5 +1,6 @@
 import json
 from collections import OrderedDict
+from contextlib import suppress
 from datetime import date, timedelta
 
 from django.conf import settings
@@ -104,6 +105,10 @@ class Teacher(models.Model):
     previous_report = models.IntegerField(default=0, verbose_name='Report précédent')
     next_report = models.IntegerField(default=0, verbose_name='Report suivant')
     archived = models.BooleanField(default=False)
+    user = models.OneToOneField(
+        settings.AUTH_USER_MODEL, on_delete=models.SET_NULL, null=True, blank=True,
+        verbose_name='Compte utilisateur'
+    )
 
     class Meta:
         verbose_name='Enseignant'
@@ -362,6 +367,12 @@ class Student(models.Model):
         age_m = int((age - age_y) * 12)
         return '%d ans%s' % (age_y, ' %d m.' % age_m if age_m > 0 else '')
 
+    def can_comment(self, user):
+        """Return True if user is authorized to edit comments for this student."""
+        with suppress(Teacher.DoesNotExist):
+            return user.has_perm('stages.change_student') or user.teacher == self.klass.teacher
+        return False
+
     def missing_examination_data(self):
         missing = []
         if not self.date_exam:
diff --git a/stages/tests.py b/stages/tests.py
index 518a90a..708bc9b 100644
--- a/stages/tests.py
+++ b/stages/tests.py
@@ -17,7 +17,7 @@ from .models import (
 from .utils import school_year
 
 
-class StagesTest(TestCase):
+class StagesTests(TestCase):
     @classmethod
     def setUpTestData(cls):
         Section.objects.bulk_create([
@@ -132,7 +132,31 @@ class StagesTest(TestCase):
         )
         self.assertNotContains(response, "Factures de supervision")
 
+    def test_comment_on_student(self):
+        teacher_user = User.objects.create_user('teach', 'teach@example.org', 'passd')
+        teacher = Teacher.objects.get(abrev='JCA')
+        teacher.user = teacher_user
+        teacher.save()
+        student = Student.objects.get(last_name='Dupond')
+        self.client.force_login(teacher_user)
+        response = self.client.get(
+            reverse("student-comment", args=(student.pk,))
+        )
+        # Cannot access form if not master teacher of that class.
+        self.assertNotContains(response, '<form')
+        student.klass.teacher = teacher
+        student.klass.save()
+        response = self.client.get(
+            reverse("student-comment", args=(student.pk,))
+        )
+        self.assertContains(
+            response,
+            '<textarea name="mc_comment" cols="40" rows="10" id="id_mc_comment" hidden="true">\n</textarea>',
+            html=True
+        )
+
     def test_attribution_view(self):
+        self.client.force_login(self.admin)
         response = self.client.get(reverse('attribution'))
         # Section select
         self.assertContains(response,
@@ -289,7 +313,7 @@ tél. 032 886 33 00
         self.assertTrue(klass5.is_Ede_ps())
 
 
-class PeriodTest(TestCase):
+class PeriodTests(TestCase):
     def setUp(self):
         self.section = Section.objects.create(name="MP_ASE")
         self.level1 = Level.objects.create(name='1')
diff --git a/stages/views/__init__.py b/stages/views/__init__.py
index efc9310..1d8637d 100644
--- a/stages/views/__init__.py
+++ b/stages/views/__init__.py
@@ -154,6 +154,13 @@ class StudentCommentView(UpdateView):
     model = Student
     form_class = StudentCommentForm
 
+    def get_context_data(self, **kwargs):
+        context = super().get_context_data(**kwargs)
+        # Only authorized teachers can comment on the student.
+        if not self.object.can_comment(self.request.user):
+            del context['form']
+        return context
+
     def get_success_url(self):
         messages.success(
             self.request, "L'enregistrement des commentaires pour %s a réussi." % self.object
diff --git a/templates/student_comment.html b/templates/student_comment.html
index 2230bef..f670dff 100644
--- a/templates/student_comment.html
+++ b/templates/student_comment.html
@@ -43,6 +43,7 @@ input[name$='titre'] { width: 40em; }
 <div class="block"><span class="label">Orientation :</span> {{ student.option_ase }}</div>
 {% endif %}
 
+{% if form %}
 <form method="post" action="." enctype="multipart/form-data">{% csrf_token %}
     {{ form.as_p }}
 
@@ -52,5 +53,6 @@ input[name$='titre'] { width: 40em; }
     {% endfor %}
     <button class="button" type="submit">Enregistrer</button>
 </form>
+{% endif %}
 
 {% endblock %}