diff --git a/rowers/views.py b/rowers/views.py index a3c02290..ad0fc39c 100644 --- a/rowers/views.py +++ b/rowers/views.py @@ -12638,8 +12638,15 @@ def plannedsession_view(request,id=0,rowerid=0, coursescript = '' coursediv = '' - if ps.manager != request.user and r not in ps.rower.all(): - raise PermissionDenied("You do not have access to this session") + if ps.manager != request.user: + if r.rowerplan == 'coach': + teams = Team.objects.filter(manager=request.user) + members = Rower.objects.filter(team__in=teams).distinct() + teamusers = [m.user for m in members] + if ps.manager not in teamusers: + raise PermissionDenied("You do not have access to this session") + elif r not in ps.rower.all(): + raise PermissionDenied("You do not have access to this session") resultsdict = get_session_metrics(ps) resultsdict = pd.DataFrame(resultsdict).transpose().to_dict()