moved user and workout permission checks to rules

updated workoutviews, rest of views not done
doesn't pass tests

rowers/views/statements.py

@@ -32,10 +32,17 @@ from icalendar import Calendar, Event
 
 from functools import reduce
 
+from rules.contrib.views import PermissionRequiredMixin
+
 import rowers.braintreestuff as braintreestuff
 import rowers.payments as payments
 from rowers.opaque import encoder
 
+from rowers.rower_rules import (
+    ispromember,is_coach_user,is_team_member,is_rower_team_member,
+    is_workout_user
+    )
+
 from django.shortcuts import render
 from django.template.loader import render_to_string
 
@@ -98,7 +105,7 @@ from rowers.models import (
     TrainingMesoCycleForm, TrainingMicroCycleForm,
     RaceLogo,RowerBillingAddressForm,PaidPlan,
     AlertEditForm, ConditionEditForm,
-    PlannedSessionComment,CoachRequest,CoachOffer,checkaccessplanuser,
+    PlannedSessionComment,CoachRequest,CoachOffer,
     VideoAnalysis
     )
 from rowers.models import (
@@ -275,6 +282,11 @@ def getfavorites(r,row):
 
     return favorites,maxfav
 
+def get_workout_by_opaqueid(request,id,**kwargs):
+    pk = encoder.decode_hex(id)
+    return get_object_or_404(Workout,pk=pk)
+
+
 def get_workout_default_page(request,id):
     if request.user.is_anonymous:
         return reverse('workout_view',kwargs={'id':id})
@@ -310,7 +322,7 @@ def getrequestrower(request,rowerid=0,userid=0,notpermanent=False):
     except Rower.DoesNotExist:
         raise Http404("Rower doesn't exist")
 
-    if not checkaccessuser(request.user,r):
+    if userid != 0 and not is_coach_user(u,r):
         raise PermissionDenied("You have no access to this user")
 
     if notpermanent == False:
@@ -343,7 +355,7 @@ def getrequestplanrower(request,rowerid=0,userid=0,notpermanent=False):
     except Rower.DoesNotExist:
         raise Http404("Rower doesn't exist")
 
-    if not checkaccessplanuser(request.user,r):
+    if not is_coach_user(request.user,r):
         raise PermissionDenied("You have no access to this user")
 
     if notpermanent == False:
@@ -377,21 +389,6 @@ def get_workout(id):
 
     return w
 
-def get_workout_permitted(user,id):
-    w = get_workout(id)
-
-    if (checkworkoutuser(user,w)==False):
-        raise PermissionDenied("Access denied")
-
-    return w
-
-def get_workout_permittedview(user,id):
-    w = get_workout(id)
-
-    if (checkworkoutuserview(user,w)==False):
-        raise PermissionDenied("Access denied")
-
-    return w
 
 def getvalue(data):
     perc = 0
@@ -774,9 +771,9 @@ def get_stored_tasks_status(request):
 
     return taskstatus
 
-@login_required()
+@permission_required('workout.change_workout',fn=get_workout_by_opaqueid,raise_exception=True)
 def get_thumbnails(request,id):
-    row = get_workout_permitted(request.user,id)
+    row = get_workout_by_opaqueid(request,id)
 
 
     r = getrower(request.user)
@@ -861,27 +858,6 @@ def get_blog_posts_old(request):
 
 
 
-@login_required()
-def get_testscript(request,id):
-    row = get_workout_permitted(request.user,id)
-    r = getrower(request.user)
-
-    object = {
-        "script":"""
-<div id="id_script">
-    <script>alert("hi")</script>
-</div>
-        """,
-        "div":"""
-<div id="id_div">
-Hoi
-</div>
-"""
-        }
-
-
-    return JSONResponse([object,object])
-
 @login_required()
 def session_jobs_view(request):
     taskstatus = get_stored_tasks_status(request)
@@ -990,10 +966,6 @@ from rowers.utils import (
 
 import rowers.datautils as datautils
 
-from rowers.models import (
-    checkworkoutuser,checkaccessuser,checkviewworkouts,checkworkoutuserview
-    )
-
 # Check if a user is a Coach member
 def iscoachmember(user):
     if not user.is_anonymous:
@@ -1044,21 +1016,7 @@ def hasplannedsessions(user):
     return result
 
 from rowers.utils import ProcessorCustomerError
-from rowers.utils import isprorower
 
-# Check if a user is a Pro member
-def ispromember(user):
-    if user and not user.is_anonymous:
-        try:
-            r = Rower.objects.get(user=user)
-        except Rower.DoesNotExist:
-            r = Rower(user=user)
-            r.save()
-
-        result = user.is_authenticated and isprorower(r)
-    else:
-        result = False
-    return result
 
 # More User/Rower utils
 def add_defaultfavorites(r):