From 3e0b98fab889ee37c88a6a2d6c986a7b1b2327cb Mon Sep 17 00:00:00 2001
From: Sander Roosendaal <roosendaalsander@gmail.com>
Date: Wed, 24 Jan 2018 14:55:18 +0100
Subject: [PATCH] easy changing to athlete's workouts list for coaches

---
 rowers/models.py                    | 16 ++++++++++++++++
 rowers/templates/list_workouts.html | 27 +++++++++++++++++++++++----
 rowers/urls.py                      |  4 ++++
 rowers/views.py                     | 19 ++++++++++++++++---
 4 files changed, 59 insertions(+), 7 deletions(-)

diff --git a/rowers/models.py b/rowers/models.py
index 2838451b..8fa1f441 100644
--- a/rowers/models.py
+++ b/rowers/models.py
@@ -623,6 +623,22 @@ def checkworkoutuser(user,workout):
     except Rower.DoesNotExist:
 	return False
 
+# Check if user is coach or rower
+def checkaccessuser(user,rower):
+    try:
+        r = Rower.objects.get(user=user)
+        teams = Team.objects.filter(manager=user)
+        if rower == r:
+            return True
+        elif teams:
+            for team in teams:
+                if team in rower.team.all():
+                    return True
+        else:
+            return False
+    except Rower.DoesNotExist:
+        return False
+    
 timezones = (
     (x,x) for x in pytz.common_timezones
 )
diff --git a/rowers/templates/list_workouts.html b/rowers/templates/list_workouts.html
index 4a1963a9..82b4bba2 100644
--- a/rowers/templates/list_workouts.html
+++ b/rowers/templates/list_workouts.html
@@ -50,7 +50,6 @@
 
 <div class="grid_12">
 
-  Select start and end date for a date range:
   <div class="grid_4 alpha">
 
     {% if team %}
@@ -64,9 +63,25 @@
       </table>
       {% csrf_token %}
   </div>
-  <div class="grid_2 suffix_6 alpha">
+  <div class="grid_2">
     <input name='daterange' class="button green" type="submit" value="Submit">	</form>
   </div>
+    {% if user.is_authenticated and user|is_manager %}
+    <div class="grid_2 omega dropdown">
+      <button class="grid_2 alpha button green small dropbtn">
+        Change Rower
+      </button>
+      <div class="dropdown-content">
+        {% for member in user|team_members %}
+        <a class="button green small" href="/rowers/u/{{ member.id }}/list-workouts/{{ startdate|date:"Y-m-d" }}/{{ enddate|date:"Y-m-d" }}">{{ member.first_name }} {{ member.last_name }}</a>
+        {% endfor %}
+      </div>
+    </div>
+      {% else %}
+      &nbsp;
+      
+      {% endif %}
+
 
 </div>
 
@@ -77,11 +92,12 @@
 {% endif %}
 
 <div class="grid_12">
+
   <div id="workouts_table" class="grid_8 alpha">
     {% if team %}
     <h3>{{ team.name }} Team Workouts</h3>
     {% else %}
-    <h3>My Workouts</h3>
+    <h3>Workouts of {{ rower.user.first_name }} {{ rower.user.last_name }}</h3>
     {% endif %}
 
     {% if workouts %}
@@ -154,7 +170,10 @@
           </td>
           {% else %}
           <td colspan="2">
-            {{ workout.user.user.first_name }} {{ workout.user.user.last_name }}
+            <a class="small" href="/rowers/{{ workout.user.id }}/list-workouts">
+              {{ workout.user.user.first_name }}
+              {{ workout.user.user.last_name }}
+              </a>
           </td>
           {% endif %}
           <td> <a class="small" href="/rowers/workout/{{ workout.id }}/flexchart">Flex</a> </td>
diff --git a/rowers/urls.py b/rowers/urls.py
index f2d291f9..3519e07c 100644
--- a/rowers/urls.py
+++ b/rowers/urls.py
@@ -137,6 +137,10 @@ urlpatterns = [
     url(r'^list-workouts/ranking$',views.workouts_view,{'rankingonly':True}),
     url(r'^list-workouts/team/(?P<teamid>\d+)/(?P<startdatestring>\w+.*)/(?P<enddatestring>\w+.*)$',views.workouts_view),
     url(r'^list-workouts/team/(?P<teamid>\d+)/$',views.workouts_view),
+    url(r'^(?P<rowerid>\d+)/list-workouts/$',views.workouts_view),
+    url(r'^(?P<rowerid>\d+)/list-workouts/(?P<startdatestring>\w+.*)/(?P<enddatestring>\w+.*)$',views.workouts_view),
+    url(r'^u/(?P<userid>\d+)/list-workouts/$',views.workouts_view),
+    url(r'^u/(?P<userid>\d+)/list-workouts/(?P<startdatestring>\w+.*)/(?P<enddatestring>\w+.*)$',views.workouts_view),
     url(r'^list-workouts/(?P<startdatestring>\w+.*)/(?P<enddatestring>\w+.*)$',views.workouts_view),
     url(r'^list-workouts/$',views.workouts_view),
     url(r'^addmanual/$',views.addmanual_view),
diff --git a/rowers/views.py b/rowers/views.py
index d175392b..88dea3be 100644
--- a/rowers/views.py
+++ b/rowers/views.py
@@ -735,7 +735,7 @@ from utils import (
 
 import datautils
 
-from rowers.models import checkworkoutuser
+from rowers.models import checkworkoutuser,checkaccessuser
 
 # Check if a user is a Coach member
 def iscoachmember(user):
@@ -6025,18 +6025,31 @@ def workouts_view(request,message='',successmessage='',
                   startdatestring="",enddatestring="",
                   startdate=timezone.now()-datetime.timedelta(days=365),
                   enddate=timezone.now()+datetime.timedelta(days=1),
-                  teamid=0,rankingonly=False):
+                  teamid=0,rankingonly=False,rowerid=0,userid=0):
     request.session['referer'] = absolute(request)['PATH']
     try:
-	r = getrower(request.user)
+        if rowerid != 0:
+            r = Rower.objects.get(id=rowerid)
+        elif userid != 0:
+            u = User.objects.get(id=userid)
+            r = getrower(u)
+        else:
+	    r = getrower(request.user)
+            
     except Rower.DoesNotExist:
         raise Http404("Rower doesn't exist")
 
+    # check if access is allowed
+    if not checkaccessuser(request.user,r):
+        raise Http404("You are not allowed access to these data")
+
     if request.method == 'POST':
         dateform = DateRangeForm(request.POST)
         if dateform.is_valid():
             startdate = dateform.cleaned_data['startdate']
             enddate = dateform.cleaned_data['enddate']
+            startdatestring = None
+            enddatestring = None
     else:
         dateform = DateRangeForm(initial={
             'startdate':startdate,