improved (fixed) rules and two additional tests for permissions

rowers/models.py

@@ -941,6 +941,7 @@ class CoachOffer(models.Model):
 
 from django.db.models.signals import m2m_changed
 
+
 def check_teams_on_change(sender, **kwargs):
     instance = kwargs.pop('instance', None)
     action = kwargs.pop('action', None)
@@ -1282,6 +1283,18 @@ class TrainingTarget(models.Model):
 
         return stri
 
+def check_trainingtarget_on_change(sender,**kwargs):
+    instance = kwargs.pop('instance',None)
+    action = kwargs.pop('action',None)
+    pk_set = kwargs.pop('pk_set',None)
+    if action == 'pre_add':
+        for id in pk_set:
+            rower = Rower.objects.get(id=id)
+            if not can_plan_user(instance.manager.user,rower):
+                raise ValidationError("You cannot add this rower. Not your coachee")
+
+m2m_changed.connect(check_trainingtarget_on_change, sender=TrainingTarget.rowers.through)
+
 class TrainingTargetForm(ModelForm):
     class Meta:
         model = TrainingTarget
@@ -1356,6 +1369,8 @@ class TrainingPlan(models.Model):
                 "Basic user cannot have a training plan"
             )
 
+
+
         if self.enddate < self.startdate:
             startdate = self.startdate
             enddate = self.enddate
@@ -1365,6 +1380,13 @@ class TrainingPlan(models.Model):
         if not self.enddate <= self.startdate:
             super(TrainingPlan,self).save(*args, **kwargs)
 
+        # only add athletes that are allowed to be added
+        for rower in self.rowers.all():
+            if can_plan_user(manager.user,rower):
+                self.rowers.add(rower)
+            else:
+                self.rowers.remove(rower)
+
         if self.status:
             otherplans = TrainingPlan.objects.filter(
                 status=True).exclude(
@@ -1401,6 +1423,18 @@ class TrainingPlan(models.Model):
         else:
             createmacrofillers(self)
 
+def check_trainingplan_on_change(sender, **kwargs):
+    instance = kwargs.pop('instance',None)
+    action = kwargs.pop('action',None)
+    pk_set = kwargs.pop('pk_set',None)
+    if action == 'pre_add':
+        for id in pk_set:
+            rower = Rower.objects.get(id=id)
+            if not can_plan_user(instance.manager.user,rower):
+                raise ValidationError("You cannot add this rower. Not your coachee")
+
+m2m_changed.connect(check_trainingplan_on_change, sender=TrainingPlan.rowers.through)
+
 
 class TrainingPlanForm(ModelForm):
     class Meta: