From 409f725caa1b82bb31cf20af12ff1454e771ff6f Mon Sep 17 00:00:00 2001
From: Sander Roosendaal <roosendaalsander@gmail.com>
Date: Mon, 18 Feb 2019 18:17:56 +0100
Subject: [PATCH] needs some work on plan page

---
 rowers/models.py                    | 11 +++++++++++
 rowers/templates/menu_plan.html     | 29 ++++++++++++++---------------
 rowers/templates/menu_workouts.html | 23 ++++++++++++-----------
 rowers/tests/test_permissions.py    |  7 +++++++
 rowers/views/statements.py          |  2 +-
 rowers/views/workoutviews.py        |  2 +-
 6 files changed, 46 insertions(+), 28 deletions(-)

diff --git a/rowers/models.py b/rowers/models.py
index a846a2aa..878b71e5 100644
--- a/rowers/models.py
+++ b/rowers/models.py
@@ -1023,6 +1023,17 @@ def checkworkoutuser(user,workout):
     except Rower.DoesNotExist:
 	return False
 
+def checkviewworkouts(user,rower):
+    try:
+        r = user.rower
+        if rower == r:
+            return True
+        teams = Team.objects.filter(manager=user)
+        print Rower.objects.filter(team__in=teams)
+        if rower in Rower.objects.filter(team__in=teams):
+            return True
+    except Rower.DoesNotExist:
+        return False
 
 # Check if user is coach or rower
 def checkaccessuser(user,rower):
diff --git a/rowers/templates/menu_plan.html b/rowers/templates/menu_plan.html
index 8dc3add6..47113564 100644
--- a/rowers/templates/menu_plan.html
+++ b/rowers/templates/menu_plan.html
@@ -82,27 +82,26 @@
 
 <p>&nbsp;</p>
 
-
-
 {% if user.is_authenticated and user|is_manager %}
 <p>&nbsp;</p>
-
-{% if user|coach_rowers %}
+{% if user|team_members %}
 <ul class="cd-accordion-menu animated">
   <li class="has-children" id="athletes">
     <input type="checkbox" name="athlete-selector" id="athlete-selector">
-    <label for="athlete-selector"><i class="fas fa-users fa-fw"></i>&nbsp;Athletes</label>
+    <label for="athlete-selector"><i class="fas fa-users fa-fw"></i>&nbsp;Group Members</label>
     <ul>
-      {% for member in user|coach_rowers %}
-      <a href={{ request.path|userurl:member.user }}?when={{ timeperiod }}>
-        <i class="fas fa-user fa-fw"></i>
-        {% if member.user == rower.user %}
-        &bull;
-        {% else %}
-        &nbsp; 
-        {% endif %}
-        {{ member.user.first_name }} {{ member.user.last_name }}
-      </a>
+      {% for member in user|team_members %}
+      <li>
+        <a href={{ request.path|userurl:member }}>
+          <i class="fas fa-user fa-fw"></i>
+          {% if member == rower.user and not team %}
+          &bull;
+          {% else %}
+          &nbsp; 
+          {% endif %}
+          {{ member.first_name }} {{ member.last_name }}
+        </a>
+      </li>
       {% endfor %}
     </ul>
   </li>
diff --git a/rowers/templates/menu_workouts.html b/rowers/templates/menu_workouts.html
index 211e9167..8bb7b8fb 100644
--- a/rowers/templates/menu_workouts.html
+++ b/rowers/templates/menu_workouts.html
@@ -45,8 +45,11 @@
   </li>
 </ul> <!-- cd-accordion-menu -->
 
+
+
 {% if user.is_authenticated and user|is_manager %}
 <p>&nbsp;</p>
+
 {% if user|coach_rowers %}
 <ul class="cd-accordion-menu animated">
   <li class="has-children" id="athletes">
@@ -54,17 +57,15 @@
     <label for="athlete-selector"><i class="fas fa-users fa-fw"></i>&nbsp;Athletes</label>
     <ul>
       {% for member in user|coach_rowers %}
-      <li>
-        <a href={{ request.path|userurl:member.user }}>
-          <i class="fas fa-user fa-fw"></i>
-          {% if member.user == rower.user and not team %}
-          &bull;
-          {% else %}
-          &nbsp; 
-          {% endif %}
-          {{ member.user.first_name }} {{ member.user.last_name }}
-        </a>
-      </li>
+      <a href={{ request.path|userurl:member.user }}?when={{ timeperiod }}>
+        <i class="fas fa-user fa-fw"></i>
+        {% if member == rower.user %}
+        &bull;
+        {% else %}
+        &nbsp; 
+        {% endif %}
+        {{ member.user.first_name }} {{ member.user.last_name }}
+      </a>
       {% endfor %}
     </ul>
   </li>
diff --git a/rowers/tests/test_permissions.py b/rowers/tests/test_permissions.py
index dc7ecdc2..4b1122fd 100644
--- a/rowers/tests/test_permissions.py
+++ b/rowers/tests/test_permissions.py
@@ -1414,3 +1414,10 @@ class PermissionsCoachingTests(TestCase):
 ## Basic and Pro users can create races
 
 ## Basic users can subscribe to any race
+
+
+# group related
+
+## group members can see but not edit each other's workouts and charts
+
+## group members can see but not edit each other's plans
diff --git a/rowers/views/statements.py b/rowers/views/statements.py
index 1a8ee0ae..4cb64194 100644
--- a/rowers/views/statements.py
+++ b/rowers/views/statements.py
@@ -911,7 +911,7 @@ from rowers.utils import (
 
 import rowers.datautils as datautils
 
-from rowers.models import checkworkoutuser,checkaccessuser
+from rowers.models import checkworkoutuser,checkaccessuser,checkviewworkouts
 
 # Check if a user is a Coach member
 def iscoachmember(user):
diff --git a/rowers/views/workoutviews.py b/rowers/views/workoutviews.py
index 557927aa..0a577e51 100644
--- a/rowers/views/workoutviews.py
+++ b/rowers/views/workoutviews.py
@@ -1157,7 +1157,7 @@ def workouts_view(request,message='',successmessage='',
     r = getrequestrower(request,rowerid=rowerid,userid=userid)
 
     # check if access is allowed
-    if not checkaccessuser(request.user,r):
+    if not checkviewworkouts(request.user,r):
         raise PermissionDenied("Access denied")
 
     if startdatestring: