Merge branch 'feature/rules' into develop

requirements.txt

@@ -174,7 +174,7 @@ ratelim==0.1.6
 redis==3.2.1
 requests==2.21.0
 requests-oauthlib==1.2.0
-rowingdata==2.6.4
+rowingdata==2.6.7
 rowingphysics==0.5.0
 rq==0.13.0
 rules==2.1

rowers/c2stuff.py

@@ -14,6 +14,7 @@ import datetime
 from requests import Request, Session
 import rowers.mytypes as mytypes
 from rowers.mytypes import otwtypes
+from rowers.rower_rules import is_workout_user,ispromember
 from iso8601 import ParseError
 
 import numpy
@@ -155,7 +156,7 @@ def add_stroke_data(user,c2id,workoutid,startdatetime,csvfilename,
 
 def get_c2_workouts(rower):
 
-    if not isprorower(rower):
+    if not ispromember(rower.user):
         return 0
 
     try:
@@ -863,7 +864,7 @@ def workout_c2_upload(user,w):
     r = Rower.objects.get(user=user)
 
     # ready to upload. Hurray
-    if (checkworkoutuser(user,w)):
+    if (is_workout_user(user,w)):
         c2userid = get_userid(r.c2token)
         if not c2userid:
             raise NoTokenError("User has no token")

rowers/dataprepnodjango.py

@@ -140,10 +140,10 @@ def timedeltaconv(x):
 
 def rdata(file,rower=rrower()):
     try:
-        res = rrdata(file,rower=rower)
+        res = rrdata(csvfile=file,rower=rower)
     except IOError:
         try:
-            res = rrdata(file+'.gz',rower=rower)
+            res = rrdata(csvfile=file+'.gz',rower=rower)
         except IOError:
             res = 0
 
@@ -948,7 +948,7 @@ def smalldataprep(therows,xparam,yparam1,yparam2):
         f1 = workout.csvfilename
 
         try:
-            rowdata = dataprep(rrdata(f1).df)
+            rowdata = dataprep(rrdata(csvfile=f1).df)
 
             rowdata = pd.DataFrame({xparam: rowdata[xparam],
                                     yparam1: rowdata[yparam1],
@@ -960,7 +960,7 @@ def smalldataprep(therows,xparam,yparam1,yparam2):
             df = pd.concat([df,rowdata],ignore_index=True)
         except IOError:
             try:
-                rowdata = dataprep(rrdata(f1+'.gz').df)
+                rowdata = dataprep(rrdata(csvfile=f1+'.gz').df)
                 rowdata = pd.DataFrame({xparam: rowdata[xparam],
                                         yparam1: rowdata[yparam1],
                                         yparam2: rowdata[yparam2],

rowers/decorators.py

@@ -4,6 +4,7 @@ from __future__ import print_function
 from __future__ import unicode_literals
 
 from django.contrib.auth.decorators import login_required,user_passes_test
+from django.urls import reverse
 
 from django.http import HttpResponseRedirect
 from django.core.exceptions import PermissionDenied
@@ -29,6 +30,9 @@ def user_passes_test(test_func, message=default_message,login_url=None,redirect_
     def decorator(view_func):
         @wraps(view_func, assigned=available_attrs(view_func))
         def _wrapped_view(request, *args, **kwargs):
+            if request.user.is_anonymous:
+                url = reverse('login')+'?next='+request.path
+                return HttpResponseRedirect(url)
             if not test_func(request.user):
                 messages.error(request, message)
                 return HttpResponseRedirect(login_url)
@@ -48,4 +52,3 @@ def login_required_message(function=None, message=default_message):
     if function:
         return actual_decorator(function)
     return actual_decorator
-

rowers/forms.py

@@ -1404,6 +1404,7 @@ class FlexAxesForm(forms.Form):
         extrametrics = kwargs.pop('extrametrics',[])
         super(FlexAxesForm, self).__init__(*args, **kwargs)
 
+
         rower = Rower.objects.get(user=request.user)
 
         axchoicespro = (

rowers/imports.py

@@ -43,7 +43,7 @@ from django.contrib.auth.decorators import login_required
 # from .models import Profile
 from rowingdata import rowingdata, make_cumvalues
 import pandas as pd
-from rowers.models import Rower,Workout,checkworkoutuser,TombStone
+from rowers.models import Rower,Workout,TombStone
 import rowers.mytypes as mytypes
 from rowsandall_app.settings import (
     C2_CLIENT_ID, C2_REDIRECT_URI, C2_CLIENT_SECRET,
@@ -54,7 +54,7 @@ from rowsandall_app.settings import (
 
 from rowers.utils import (
     NoTokenError, custom_exception_handler, ewmovingaverage,
-    geo_distance,isprorower,uniqify
+    geo_distance,uniqify
     )
 
 
@@ -144,7 +144,7 @@ def imports_do_refresh_token(refreshtoken,oauth_data,access_token=''):
         else:
             grant_type = post_data.pop('grant_type',None)
 
-    if oauth_data['bearer_auth']:        
+    if oauth_data['bearer_auth']:
         headers['authorization'] = 'Bearer %s' % access_token
 
     baseurl = oauth_data['base_url']
@@ -159,7 +159,7 @@ def imports_do_refresh_token(refreshtoken,oauth_data,access_token=''):
                                  headers=headers)
 
 
-        
+
     if response.status_code == 200 or response.status_code == 201:
         token_json = response.json()
     else:
@@ -186,7 +186,7 @@ def imports_do_refresh_token(refreshtoken,oauth_data,access_token=''):
         expires_in = int(expires_in)
     except (TypeError,ValueError):
         expires_in = 0
-        
+
 
     return [thetoken,expires_in,refresh_token]
 
@@ -199,20 +199,20 @@ def imports_get_token(
     client_secret = oauth_data['client_secret']
     client_id = oauth_data['client_id']
     base_uri = oauth_data['base_url']
-    
+
 
     client_auth = requests.auth.HTTPBasicAuth(
         client_id,client_secret
         )
 
-        
+
     post_data = {"grant_type": "authorization_code",
                  "code": code,
                  "redirect_uri": redirect_uri,
                  "client_secret": client_secret,
                  "client_id": client_id,
                  }
-    
+
     try:
         headers = oauth_data['headers']
     except KeyError:
@@ -229,7 +229,7 @@ def imports_get_token(
         else:
             grant_type = post_data.pop('grant_type',None)
 
-            
+
     if 'json' in oauth_data['content_type']:
         response = requests.post(
             base_uri,
@@ -262,7 +262,7 @@ def imports_get_token(
     else:
         return [0,0,0]
 
-    
+
     return [thetoken,expires_in,refresh_token]
 
 # Make authorization URL including random string
@@ -293,8 +293,8 @@ def imports_token_refresh(user,tokenname,refreshtokenname,expirydatename,oauth_d
     # for Strava transition
     if not refreshtoken:
         refreshtoken = getattr(r,tokenname)
-        
-    
+
+
     res = imports_do_refresh_token(refreshtoken,oauth_data)
     access_token = res[0]
     expires_in = res[1]
@@ -309,4 +309,3 @@ def imports_token_refresh(user,tokenname,refreshtokenname,expirydatename,oauth_d
 
     r.save()
     return access_token
-

rowers/interactiveplots.py

@@ -2680,7 +2680,10 @@ def interactive_windchart(id=0,promember=0):
     if rowdata == 0:
         return 0
 
-    dist = rowdata.df.loc[:,'cum_dist']
+    try:
+        dist = rowdata.df.loc[:,'cum_dist']
+    except KeyError:
+        return ['','No Data Found']
 
     try:
         vwind = rowdata.df.loc[:,'vwind']
@@ -2770,7 +2773,10 @@ def interactive_streamchart(id=0,promember=0):
     if rowdata == 0:
         return "","No Valid Data Available"
 
-    dist = rowdata.df.loc[:,'cum_dist']
+    try:
+        dist = rowdata.df.loc[:,'cum_dist']
+    except KeyError:
+        return ['','No Data found']
 
     try:
         vstream = rowdata.df.loc[:,'vstream']

rowers/mailprocessing.py

@@ -64,18 +64,18 @@ def send_confirm(user, name, link, options):
 def rdata(file, rower=rrower()):
     """ Reads rowingdata data or returns 0 on Error """
     try:
-        result = rrdata(file, rower=rower)
+        result = rrdata(csvfile=file, rower=rower)
     except IOError:
         try:
-            result = rrdata(file + '.gz', rower=rower)
+            result = rrdata(csvfile=file + '.gz', rower=rower)
         except IOError:
             result = 0
     except TypeError:
         try:
-            result = rrdata(file)
+            result = rrdata(csvfile=file)
         except IOError:
             try:
-                result = rrdata(file+'.gz', rower=rower)
+                result = rrdata(csvfile=file+'.gz', rower=rower)
             except IOError:
                 result = 0
 

rowers/models.py

@@ -39,6 +39,10 @@ import pandas as pd
 from dateutil import parser
 import datetime
 
+#from rules.contrib.models import RulesModel
+
+from rowers.rower_rules import *
+
 from rowers.rows import validate_file_extension
 from collections import OrderedDict
 from timezonefinder import TimezoneFinder
@@ -53,6 +57,10 @@ from rowsandall_app.settings import (
     TWEET_CONSUMER_SECRET,
     )
 
+
+
+# END PERMISSIONS
+
 tweetapi = twitter.Api(consumer_key=TWEET_CONSUMER_KEY,
                        consumer_secret=TWEET_CONSUMER_SECRET,
                        access_token_key=TWEET_ACCESS_TOKEN_KEY,
@@ -322,14 +330,7 @@ class C2WorldClassAgePerformance(models.Model):
 
         return thestring
 
-def is_not_basic(user):
-    if user.rower.rowerplan == 'basic':
-        raise ValidationError(
-            "Basic user cannot be team manager"
-            )
 
-
-# For future Team functionality
 @python_2_unicode_compatible
 class Team(models.Model):
     choices = (
@@ -344,30 +345,28 @@ class Team(models.Model):
 
     name = models.CharField(max_length=150,unique=True,verbose_name='Team Name')
     notes = models.CharField(blank=True,max_length=200,verbose_name='Team Purpose')
-    manager = models.ForeignKey(User, null=True,on_delete=models.CASCADE) # validators=[is_not_basic])
+    manager = models.ForeignKey(User, null=True,on_delete=models.CASCADE)
     private = models.CharField(max_length=30,choices=choices,default='open',
                                verbose_name='Team Type')
 
     viewing = models.CharField(max_length=30,choices=viewchoices,default='allmembers',verbose_name='Sharing Behavior')
 
 
+
     def __str__(self):
         return self.name
 
     def save(self, *args, **kwargs):
         manager = self.manager
-        if manager.rower.rowerplan == 'basic':
-            if manager.rower.protrialexpires < datetime.date.today() and manager.rower.plantrialexpires < datetime.date.today():
+        if not can_have_teams(manager):
                 raise ValidationError(
                     "Basic user cannot be team manager"
                 )
 
-        if manager.rower.rowerplan in ['plan','pro']:
-            otherteams = Team.objects.filter(manager=manager)
-            if otherteams.count() >= 1:
-                raise ValidationError(
-                    "Pro and Self-Coach users cannot have more than one team"
-                    )
+        if not can_add_team(manager):
+            raise ValidationError(
+                "Pro and Self-Coach users cannot have more than one team"
+                )
 
         super(Team, self).save(*args,**kwargs)
 
@@ -658,6 +657,9 @@ class CoachingGroup(models.Model):
         rs = Rower.objects.filter(coachinggroups__in=[self])
         return rs.count()
 
+    def get_coaches(self):
+        return Rower.objects.filter(mycoachgroup=self)
+
 # Extension of User with rowing specific data
 @python_2_unicode_compatible
 class Rower(models.Model):
@@ -896,6 +898,20 @@ class Rower(models.Model):
 
         super(Rower, self).save(*args, **kwargs)
 
+    def get_managed_teams(self):
+        return Team.objects.filter(manager=self.user)
+
+    def get_coaches(self):
+        coaches = []
+        for group in self.coachinggroups.all():
+            try:
+                coach = Rower.objects.get(mycoachgroup=group)
+                coaches.append(coach)
+            except Rower.DoesNotExist:
+                pass
+
+        return coaches
+
 class DeactivateUserForm(forms.ModelForm):
     class Meta:
         model = User
@@ -925,18 +941,19 @@ class CoachOffer(models.Model):
 
 from django.db.models.signals import m2m_changed
 
+
 def check_teams_on_change(sender, **kwargs):
     instance = kwargs.pop('instance', None)
     action = kwargs.pop('action', None)
     pk_set = kwargs.pop('pk_set',None)
-    if action == 'pre_add' and instance.rowerplan=='basic':
-        if instance.protrialexpires < datetime.date.today() and instance.plantrialexpires < datetime.date.today():
-            for id in pk_set:
-                team = Team.objects.get(id=id)
-                if team.manager.rower.rowerplan not in ['coach']:
-                    raise ValidationError(
-                        "You cannot join a team led by a Pro, Free Coach Plan or Self-Coach user"
-                    )
+    if action == 'pre_add':
+        #if instance.protrialexpires < datetime.date.today() and instance.plantrialexpires < datetime.date.today():
+        for id in pk_set:
+            team = Team.objects.get(id=id)
+            if not can_join_team(instance.user,team):
+                raise ValidationError(
+                    "You cannot join a team led by a Pro, Free Coach Plan or Self-Coach user"
+                )
 
 m2m_changed.connect(check_teams_on_change, sender=Rower.team.through)
 
@@ -1165,95 +1182,7 @@ class BasePlannedSessionFormSet(BaseFormSet):
             return
 
 
-# Check if workout is owned by this user
-def checkworkoutuser(user,workout):
-    if user.is_anonymous:
-        return False
-    try:
-        r = Rower.objects.get(user=user)
-        if workout.user == r:
-            return True
-        coaches = []
-        for group in workout.user.coachinggroups.all():
-            coach = Rower.objects.get(mycoachgroup=group)
-            coaches.append(coach)
-        for coach in coaches:
-            if user.rower == coach and workout.privacy == 'visible':
-                return True
-        else:
-            return False
-    except Rower.DoesNotExist:
-        return False
 
-# Check if workout may be viewed by this user
-def checkworkoutuserview(user,workout):
-    if user.is_anonymous:
-        return False
-    try:
-        r = Rower.objects.get(user=user)
-        if workout.user == r:
-            return True
-        teams = workout.user.team.all()
-
-        for team in teams:
-            if team in r.team.all():
-                return True
-        return False
-    except Rower.DoesNotExist:
-        return False
-
-    return False
-
-def checkviewworkouts(user,rower):
-    try:
-        r = user.rower
-        if rower == r:
-            return True
-        teams = Team.objects.filter(manager=user)
-
-        if rower in Rower.objects.filter(team__in=teams):
-            return True
-
-        if rower in Rower.objects.filter(coachinggroups__in=[user.rower.mycoachgroup]):
-            return True
-
-
-    except Rower.DoesNotExist:
-        return False
-
-# check if user is plan and rower is in his group
-def checkaccessplanuser(user,rower):
-    try:
-        r = Rower.objects.get(user=user)
-        if rower == r:
-            return True
-        team_managers = [t.manager for t in rower.team.all() if t.manager.rower.rowerplan in ['plan','coach','freecoach']]
-        if user.rower.rowerplan != 'basic':
-            return user in team_managers
-        else:
-            return False
-
-        return False
-    except Rower.DoesNotExist:
-        return False
-
-# Check if user is coach or rower
-def checkaccessuser(user,rower):
-    try:
-        r = Rower.objects.get(user=user)
-        if rower == r:
-            return True
-        coaches = []
-        for group in rower.coachinggroups.all():
-            coach = Rower.objects.get(mycoachgroup=group)
-            coaches.append(coach)
-        for coach in coaches:
-            if user.rower == coach:
-                return True
-        else:
-            return False
-    except Rower.DoesNotExist:
-        return False
 
 timezones = (
     (x,x) for x in pytz.common_timezones
@@ -1354,6 +1283,18 @@ class TrainingTarget(models.Model):
 
         return stri
 
+def check_trainingtarget_on_change(sender,**kwargs):
+    instance = kwargs.pop('instance',None)
+    action = kwargs.pop('action',None)
+    pk_set = kwargs.pop('pk_set',None)
+    if action == 'pre_add':
+        for id in pk_set:
+            rower = Rower.objects.get(id=id)
+            if not can_plan_user(instance.manager.user,rower):
+                raise ValidationError("You cannot add this rower. Not your coachee")
+
+m2m_changed.connect(check_trainingtarget_on_change, sender=TrainingTarget.rowers.through)
+
 class TrainingTargetForm(ModelForm):
     class Meta:
         model = TrainingTarget
@@ -1423,12 +1364,12 @@ class TrainingPlan(models.Model):
 
     def save(self, *args, **kwargs):
         manager = self.manager
+        if not can_add_plan(manager.user):
+            raise ValidationError(
+                "Basic user cannot have a training plan"
+            )
+
 
-        if manager.rowerplan in ['basic','pro']:
-            if manager.plantrialexpires < timezone.now().date():
-                raise ValidationError(
-                    "Basic user cannot have a training plan"
-                )
 
         if self.enddate < self.startdate:
             startdate = self.startdate
@@ -1439,6 +1380,13 @@ class TrainingPlan(models.Model):
         if not self.enddate <= self.startdate:
             super(TrainingPlan,self).save(*args, **kwargs)
 
+        # only add athletes that are allowed to be added
+        for rower in self.rowers.all():
+            if can_plan_user(manager.user,rower):
+                self.rowers.add(rower)
+            else:
+                self.rowers.remove(rower)
+
         if self.status:
             otherplans = TrainingPlan.objects.filter(
                 status=True).exclude(
@@ -1475,6 +1423,18 @@ class TrainingPlan(models.Model):
         else:
             createmacrofillers(self)
 
+def check_trainingplan_on_change(sender, **kwargs):
+    instance = kwargs.pop('instance',None)
+    action = kwargs.pop('action',None)
+    pk_set = kwargs.pop('pk_set',None)
+    if action == 'pre_add':
+        for id in pk_set:
+            rower = Rower.objects.get(id=id)
+            if not can_plan_user(instance.manager.user,rower):
+                raise ValidationError("You cannot add this rower. Not your coachee")
+
+m2m_changed.connect(check_trainingplan_on_change, sender=TrainingPlan.rowers.through)
+
 
 class TrainingPlanForm(ModelForm):
     class Meta:
@@ -2158,11 +2118,10 @@ class PlannedSession(models.Model):
 
         manager = self.manager
         if self.sessiontype not in ['race','indoorrace']:
-            if manager.rower.rowerplan in ['basic','pro']:
-                if manager.rower.plantrialexpires < timezone.now().date():
-                    raise ValidationError(
-                        "You must be a Self-Coach user or higher to create a planned session"
-                    )
+            if not can_add_session(self.manager):
+                raise ValidationError(
+                    "You must be a Self-Coach user or higher to create a planned session"
+                )
 
 
         # sort units
@@ -2769,7 +2728,7 @@ class Workout(models.Model):
 
     def save(self, *args, **kwargs):
         user = self.user
-        if self.user.rowerplan == 'freecoach':
+        if not can_add_workout(user.user):
             raise forms.ValidationError("Free Coach User cannot have any workouts")
 
         super(Workout, self).save(*args, **kwargs)

rowers/permissions.py

@@ -22,7 +22,7 @@ class IsOwnerOrReadOnly(permissions.BasePermission):
         return obj.user == request.user
 
 class IsOwnerOrNot(permissions.BasePermission):
-    
+
     def has_object_permission(self, request, view, obj):
         r = Rower.objects.get(user=request.user)
         return (obj.user == r)

rowers/polarstuff.py

@@ -38,7 +38,7 @@ from django.contrib.auth.decorators import login_required
 from rowingdata import rowingdata
 import pandas as pd
 from rowers.models import Rower,Workout
-from rowers.models import checkworkoutuser
+
 import rowers.dataprep as dataprep
 from rowers.dataprep import columndict
 
@@ -50,7 +50,7 @@ from stravalib.exc import ActivityUploadFailed,TimeoutExceeded
 from django_mailbox.models import Message,Mailbox,MessageAttachment
 
 from rowsandall_app.settings import (
-    POLAR_CLIENT_ID, POLAR_REDIRECT_URI, POLAR_CLIENT_SECRET, 
+    POLAR_CLIENT_ID, POLAR_REDIRECT_URI, POLAR_CLIENT_SECRET,
     )
 
 #baseurl = 'https://polaraccesslink.com/v3-example'
@@ -79,7 +79,7 @@ def get_token(code):
     except TypeError:
         headers = { 'Authorization': 'Basic %s' % base64.b64encode(
             bytes(auth_string,'utf-8')).decode('utf-8') }
-        
+
     response = requests.post("https://polarremote.com/v2/oauth2/token",
                              data=post_data,
                              headers=headers)
@@ -110,7 +110,7 @@ def make_authorization_url():
     import urllib
     url = "https://flow.polar.com/oauth2/authorization" +urllib.parse.urlencode(params)
 
-    
+
     return HttpResponseRedirect(url)
 
 def get_polar_notifications():
@@ -130,13 +130,13 @@ def get_polar_notifications():
     response = requests.get(url, headers=headers)
 
     available_data = []
-    
+
     if response.status_code == 200:
         available_data = response.json()['available-user-data']
-    
+
     return available_data
 
-from rowers.utils import isprorower
+from rowers.rower_rules import ispromember
 
 def get_all_new_workouts(available_data,testing=False):
     for record in available_data:
@@ -146,7 +146,7 @@ def get_all_new_workouts(available_data,testing=False):
             try:
                 r = Rower.objects.get(polaruserid=record['user-id'])
                 u = r.user
-                if r.polar_auto_import and isprorower(r):
+                if r.polar_auto_import and ispromember(u):
                     exercise_list = get_polar_workouts(u)
                     if testing:
                         print(exercise_list)
@@ -154,13 +154,13 @@ def get_all_new_workouts(available_data,testing=False):
                 pass
 
     return 1
-                                  
+
 
 def get_polar_workouts(user):
     r = Rower.objects.get(user=user)
 
     exercise_list = []
-    
+
     if (r.polartoken == '') or (r.polartoken is None):
         s = "Token doesn't exist. Need to authorize"
         return custom_exception_handler(401,s)
@@ -195,7 +195,7 @@ def get_polar_workouts(user):
                 uploadoptions,
                 default_flow_style=False
                 )
-            
+
             transactionid = response.json()['transaction-id']
             url = baseurl+'/users/{userid}/exercise-transactions/{transactionid}'.format(
                 transactionid = transactionid,
@@ -229,11 +229,11 @@ def get_polar_workouts(user):
 
                             a = MessageAttachment(message=msg,document=filename[6:])
                             a.save()
-                                
+
                             exercise_dict['filename'] = filename
                         else:
                             exercise_dict['filename'] = ''
-                            
+
                         exercise_list.append(exercise_dict)
 
             # commit transaction
@@ -280,7 +280,7 @@ def get_polar_user_info(user,physical=False):
 
 
 def get_polar_workout(user,id,transactionid):
-    
+
     r = Rower.objects.get(user=user)
     if (r.polartoken == '') or (r.polartoken is None):
         s = "Token doesn't exist. Need to authorize"
@@ -326,7 +326,7 @@ def get_polar_workout(user,id,transactionid):
                                 )
 
                             response = requests.get(url,headers = headers2)
-        
+
                             if response.status_code == 200:
                                 result = response.text
             # commit transaction
@@ -337,7 +337,3 @@ def get_polar_workout(user,id,transactionid):
         return result
 
     return None
-
-        
-    
-        

rowers/rower_rules.py

@@ -0,0 +1,708 @@
+import rules
+import datetime
+
+# PERMISSIONS
+
+# USER permissions
+
+"""
+USER permissions
+- There are 5 types of user: basic, pro, plan, coach, freecoach
+- These methods exist on user
+    - user.rower
+    - user.is_anonymous
+    - user.is_staff
+
+- These methods exist on rower
+    - rower.rowerplan
+    - rower.protrialexpires
+    - rower.plantrialexpires
+    - rower.mycoachgroup
+    - rower.coachinggroups
+    - rower.team
+
+- These Rules apply to Rowers
+    - Coach can have any number of groups
+        - test_permissions.PermissionFreeCoach.test_coach_groupmanager
+        - test_permissions.PermissionsBasicsTests.test_coach_groupmanager
+        - test_permissions.PermissionsViewTests.test_coach_groups_create
+    - Pro and Plan users can have one group and not more
+        - test_permissions.PermissionsFreeCoach.test_pro_groupmanager
+        - test_permissions.PermissionsViewTests.test_pro_groups_create
+    - Free Coach user cannot have workouts
+        - test_permissions.PermissionFreeCoach.test_add_workout_freecoach
+    - Free coach can create more than one group
+        - test_permissions.PermissionsFreeCoach.test_plan_groupmanager
+    - Free Coach & Plan (Self Coach) can create planned sessions and team planned sessions
+        - test_permissions.PermissionsFreeCoach.test_plan_create_session
+        - test_permissions.PermissionsFreeCoach.test_coach_create_session
+    - Pro cannot create planned sessions or team planned sessions
+        - test_permissions.PermissionsViewTests.test_pro_create_session
+    - Basic cannot join groups led by Free Coach
+        - test_permissions.PermissionFreeCoach.test_add_basic_pro_or_plan
+    - Coach can edit athlete settings (if in coachinggroup)
+        - test_permissions.PermissionsViewTests.test_coach_edit_athlete_prefs
+        - test_permissions.PermissionsViewTests.test_coach_edit_athlete_prefs_not
+        - test_permissions.PermissionsViewTests.test_coach_edit_athlete_settings
+        - test_permissions.PermissionsViewTests.test_coach_edit_athlete_settings_not
+        - test_permissions.PermissionsViewTests.test_coach_edit_athlete_account
+        - test_permissions.PermissionsViewTests.test_coach_edit_athlete_account_not
+        - test_permissions.PermissionsViewTests.test_coach_edit_athlete_exportsettings
+        - test_permissions.PermissionsViewTests.test_coach_edit_athlete_exportsettings_not
+    - Coach can upload a workout on behalf of athlete
+        - test_permissions.PermissionsViewTests.test_coach_edit_athlete_upload
+        - test_permissions.PermissionsViewTests.test_coach_edit_athlete_upload_not
+    - Pro and Plan cannot upload a workout on behalf of athlete
+        - test_permissions.PermissionsViewTests.test_plan_edit_athlete_upload
+    - Coach can run analytics for athlete
+        - test_permissions.PermissionsViewTests.test_coach_edit_athlete_analysis
+        - test_permissions.PermissionsViewTests.test_coach_edit_athlete_analysis_not
+        - test_permissions.PermissionsViewTests.test_pro_edit_athlete_analysis
+    - Pro and Plan user cannot run analysis for members of their groups
+        - test_permissions.PermissionsViewTests.test_plan_edit_athlete_analysis
+    - Pro and Plan user cannot edit athlete sessings
+        - test_permissions.PermissionsViewTests.test_plan_edit_athlete_settings
+        - test_permissions.PermissionsViewTests.test_pro_edit_athlete_settings
+    - Self-Coach and Pro cannot create more than one group
+        - test_permissions.PermissionsFreeCoach.test_plan_groupmanager
+    - Pro users and higher can join group led by other Pro or higher user
+        - test_permissions.PermissionsFreeCoach.test_add_proplan_pro_or_plan
+    - Pro or basic cannot create planned sessions or team planned sessions
+        - test_permissions.PermissionsFreeCoach.test_pro_create_plannedsession
+
+"""
+
+# used in can_plan_user
+@rules.predicate
+def user_is_not_basic(user):
+    if user.rower.rowerplan != 'basic':
+        return True
+
+    if user.rower.protrialexpires >= datetime.date.today() and user.rower.plantrialexpires >= datetime.date.today():
+        return True
+
+    return False
+
+@rules.predicate
+def can_start_trial(user):
+    if user.is_anonymous:
+        return False
+
+
+    return user.rower.protrialexpires == datetime.date(1970,1,1)
+
+@rules.predicate
+def can_start_plantrial(user):
+    if user.is_anonymous:
+        return False
+
+    return user.rower.plantrialexpires == datetime.date(1970,1,1)
+
+@rules.predicate
+def is_staff(user):
+    return user.is_staff
+
+@rules.predicate
+def is_coach(user):
+    return user.rower.rowerplan in ['coach','freecoach']
+
+def is_paid_coach(user):
+    return user.rower.rowerplan == 'coach'
+
+@rules.predicate
+def is_planmember(user):
+    try:
+        r = user.rower
+    except AttributeError:
+        return False
+
+    return r.rowerplan in ['coach','plan'] # freecoach?
+
+@rules.predicate
+def is_promember(user):
+    try:
+        r = user.rower
+    except AttributeError:
+        return False
+
+    return r.rowerplan in ['pro','coach','plan'] # freecoach?
+
+@rules.predicate
+def is_protrial(user):
+    try:
+        r = user.rower
+    except AttributeError:
+        return False
+
+    if r.rowerplan == 'basic':
+        return r.protrialexpires >= datetime.date.today()
+    if r.rowerplan == 'freecoach':
+        if r.mycoachgroup is not None:
+            return len(r.mycoachgroup)>=4
+
+    return False
+
+ispromember = is_promember | is_protrial
+
+can_have_teams = ispromember | is_coach
+
+@rules.predicate
+def can_add_team(user):
+    if is_coach(user):
+        return True
+
+    if ispromember(user):
+        otherteams = user.rower.get_managed_teams()
+        if otherteams.count() == 0:
+            return True
+
+    return False
+
+@rules.predicate
+def can_add_plan(user):
+    return isplanmember(user) or is_coach(user)
+
+@rules.predicate
+def can_add_workout(user):
+    if user.is_anonymous:
+        return False
+
+    return user.rower.rowerplan != 'freecoach'
+
+@rules.predicate
+def is_plantrial(user):
+    try:
+        r = user.rower
+    except AttributeError:
+        return False
+
+    if r.rowerplan in ['basic','pro']:
+        return r.plantrialexpires >= datetime.date.today()
+    if r.rowerplan == 'freecoach':
+        if r.mycoachgroup is not None:
+            return len(r.mycoachgroup)>=4
+
+    return False
+
+
+isplanmember = is_planmember | is_plantrial
+
+@rules.predicate
+def can_add_session(user):
+    return isplanmember(user) or is_coach(user)
+
+# User / Coach relationships (Rower object)
+
+@rules.predicate
+def can_plan(user):
+    return user.rower.rowerplan in ['plan','coach','freecoach']
+
+# checks if rower is coach of user (or is user himself)
+@rules.predicate
+def is_coach_user(usercoach,userrower):
+    if usercoach == userrower:
+        return True
+
+    if not is_coach(usercoach):
+        return False
+
+    r = userrower.rower
+
+    coaches = []
+
+    for group in r.coachinggroups.all():
+        newcoaches = group.get_coaches()
+        for coach in newcoaches:
+            coaches.append(coach)
+
+    for coach in coaches:
+        if usercoach.rower == coach:
+            return True
+
+    return False
+
+# checks if rower is coach of user (or is user himself)
+@rules.predicate
+def is_anonymous_or_coach(usercoach,userrower):
+    print(usercoach,userrower)
+    if usercoach == userrower:
+        return True
+
+    if userrower.is_anonymous and userrower.is_anonymous:
+        return True
+
+    if not is_coach(usercoach):
+        return False
+
+    r = userrower.rower
+
+    coaches = []
+
+    for group in r.coachinggroups.all():
+        newcoaches = group.get_coaches()
+        for coach in newcoaches:
+            coaches.append(coach)
+
+    for coach in coaches:
+        if usercoach.rower == coach:
+            return True
+
+    return False
+
+# check if rower and user are members of the same team
+@rules.predicate
+def is_rower_team_member(user,rower):
+    if user.rower == rower:
+        return True
+
+    teams = rower.team.all()
+
+    for team in teams:
+        if team.private == 'open':
+            if team in rower.team.all():
+                return True
+        if team.manager == rower.user:
+            return True
+
+    return False
+
+@rules.predicate
+def can_add_workout_member(user,rower):
+    if not user:
+        return False
+    if user.is_anonymous:
+        return False
+    if user == rower.user:
+        return True
+    # only below tested - need test user == rower.user
+    return is_coach(user) and user.rower in rower.get_coaches()
+
+# check if user can plan for the rower
+@rules.predicate
+def can_plan_user(user,rower):
+    # user must have planning permission
+    if not can_plan(user):
+        return False
+
+    # if has planning permission, can always plan for himself
+    if rower == user.rower:
+        return True
+
+    teams = user.rower.get_managed_teams()
+    # free coach, plan etc cannot plan for basic
+    if not is_paid_coach(user) and user_is_not_basic(user):
+        for t in teams:
+            if rower in t.rower.all():
+                return True
+
+    # paying coach can plan for all kinds of rowers
+    if is_paid_coach(user):
+        for t in teams:
+            if rower in t.rower.all():
+                return True
+
+    return False
+
+rules.add_perm('rower.add_plan',can_plan_user) # replaces checkaccessplanuser
+rules.add_perm('rower.is_coach',is_coach_user) # replaces checkaccessuser
+rules.add_perm('rower.is_pro',ispromember)
+rules.add_perm('rower.is_staff',is_staff)
+
+# WORKOUT permissions
+
+"""
+WORKOUT permissions
+- These methods exist on Workout
+    - workout.privacy
+
+- These rules apply to workouts
+    - User can add, delete and change their own workouts
+        - test_aworkouts
+    - Coach can add and change workouts for their athletes, but not delete
+        - test_permissions.PermissionsViewTests.test_coach_edit_athlete_upload
+        - test_permissions.PermissionsViewTests.test_coach_edit_athlete_upload_not
+    - Basic, Pro and Plan user can view but cannot add or change an athlete's workout
+        - test_permissions.PermissionsViewTests.test_coach_edit_athlete_workout
+        - test_permissions.PermissionsViewTests.test_plan_edit_athlete_upload
+        - test_permissions.PermissionsViewTests.test_plan_edit_athlete_workout
+        - test_permissions.PermissionsViewTests.test_basic_edit_athelte_workout
+    - Anonymous users can view team members' workout (but not see list of workouts)
+        - test_aworkouts
+
+    - Rules for Workouts are transferred to objects related to the Workout,
+        - Charts
+        - Video Analysis
+        - WorkoutComment?
+
+"""
+
+# check if user is owner or coach of owner of workout
+@rules.predicate
+def is_workout_user(user,workout):
+    if user.is_anonymous:
+        return False
+
+    try:
+        r = user.rower
+    except AttributeError:
+        return False
+
+    if workout.user == r:
+        return True
+
+    return is_coach_user(user,workout.user.user)
+
+# check if user is in same team as owner of workout
+@rules.predicate
+def is_workout_team(user,workout):
+    if user.is_anonymous:
+        return False
+
+    try:
+        r = user.rower
+    except AttributeError:
+        return False
+
+    if workout.user == r:
+        return True
+
+    return is_rower_team_member(user,workout.user)
+
+# check if user can see workout
+@rules.predicate
+def can_view_workout(user,workout):
+    if workout.privacy != 'private':
+        return True
+    return user.rower == workout.user
+
+can_change_workout = is_workout_user
+
+rules.add_perm('workout.change_workout',can_change_workout) # replaces checkworkoutuser
+rules.add_perm('workout.view_workout',can_view_workout) # replaces checkworkoutuserview
+
+
+
+# checkviewworkouts
+
+# PLANNING permissions
+
+"""
+- These rules apply to planning
+    - Free coach can create planned sessions and team planned sessions
+        - test_permissions.PermissionsViewTests.test_coach_create_session
+    - Self coach and higher can create planned sessions and team planned sessions
+        - test_permissions.PermissionsFreeCoach.test_plan_create_session
+        - test_permissions.PermissionsFreeCoach.test_coach_create_session
+    - Coach can create planned sessions and team planned sessions
+        - test_permissions.PermissionsFreeCoach.test_plan_create_session
+        - test_permissions.PermissionsFreeCoach.test_coach_create_session
+    - Self Coach and higher can create planned sessions and team planned sessions
+        - test_permissions.PermissionsViewTests.test_plan_create_session
+    - Pro or Basic cannot create planned sessions or team planned sessions
+        - test_permissions.PermissionsFreeCoach.test_pro_create_plannedsession
+        - test_permissions.PermissionsFreeCoach.test_basic_create_plannedsession
+    - WHO can comment (plannedsession_comment_view)
+    - Only Session manager can change session
+    - Strict View rules (stricter than workouts)
+    - Basic user cannot manage a training plan
+
+    - TrainingTarget
+        - rules for view, add, change, delete
+    - TrainingPlan
+        - rules for view, add, change, delete
+    - Cycle
+        - inherits rules from TrainingPlan
+    - PlannedSession
+        - rules for view, add, change, delete, clone, save as template
+        - check team
+
+    - Special rules for Race (cannot be edited ex post)
+
+"""
+
+# Training Target rules
+
+# untested can_view_target to can_delete_target
+@rules.predicate
+def can_view_target(user,target):
+    if user.is_anonymous:
+        return False
+    if user == target.manager.user:
+        return True
+
+    # a target's coach can view as well
+    if is_coach_user(user,target.manager.user):
+        return True
+
+    # the object can view as well
+    if user.rower in target.rowers.all():
+        return True
+
+@rules.predicate
+def can_change_target(user,target):
+    if user.is_anonymous:
+        return False
+    return user == target.manager.user
+
+@rules.predicate
+def can_delete_target(user,target):
+    if user.is_anonymous:
+        return False
+    return user == target.manager.user
+
+rules.add_perm('target.view_target',can_view_target)
+rules.add_perm('target.change_target',can_change_target)
+rules.add_perm('target.delete_target',can_delete_target)
+
+@rules.predicate
+def can_view_plan(user,plan):
+    if user.is_anonymous:
+        return False
+    if user == plan.manager.user:
+        return True
+
+    # a plan's coach can view as well
+    # below untested
+    if is_coach_user(user,plan.manager.user):
+        return True
+
+    # the object can view as well
+    if user.rower in plan.rowers.all():
+        return True
+
+@rules.predicate
+def can_change_plan(user,plan):
+    if user.is_anonymous:
+        return False
+    return user == plan.manager.user
+
+# below untested
+@rules.predicate
+def can_delete_plan(user,plan):
+    if user.is_anonymous:
+        return False
+    return user == plan.manager.user
+
+
+
+rules.add_perm('plan.view_plan',can_view_plan)
+rules.add_perm('plan.change_plan',can_change_plan)
+rules.add_perm('plan.delete_plan',can_delete_plan)
+rules.add_perm('plan.can_add_plan',can_add_plan)
+
+# untested
+@rules.predicate
+def can_view_cycle(user,cycle):
+    try:
+        return can_view_cycle(user,cycle.plan)
+    except AttributeError:
+        return can_view_plan(user,cycle.plan)
+
+    return False
+
+@rules.predicate
+def can_change_cycle(user,cycle):
+    try:
+        return can_change_cycle(user,cycle.plan)
+    except AttributeError:
+        return can_change_plan(user,cycle.plan)
+
+    return False
+
+@rules.predicate
+def can_delete_cycle(user,cycle):
+    try:
+        return can_delete_cycle(user,cycle.plan)
+    except AttributeError:
+        return can_delete_plan(user,cycle.plan)
+
+    return False
+
+
+rules.add_perm('cycle.view_cycle',can_view_cycle)
+rules.add_perm('cycle.change_cycle',can_change_cycle)
+rules.add_perm('cycle.delete_cycle',can_delete_cycle)
+
+
+# check if user has view access to session
+@rules.predicate
+def can_view_session(user,session):
+    if session.sessiontype in ['race','indoorrace']:
+        return True
+    if user.is_anonymous:
+        return False
+    # session manager can view session
+    if user == session.manager:
+        return True
+    # if you're a rower in the session you can view it
+    # below untested
+    if user.rower in session.rower.all():
+        return True
+    # coach users can view sessions created by their team members
+    # below untested
+    if is_coach(user):
+        teams = user.rower.get_managed_teams()
+        teamusers = [member.u for member in t.rower.all()]
+        if session.manager in teamusers:
+            return True
+
+    return False
+
+@rules.predicate
+def can_change_session(user,session):
+    if user.is_anonymous:
+        return False
+    # session part of a race should not be changed through the session interface
+    if session.sessiontype in ['race','indoorrace']:
+        return False
+    if user == session.manager:
+        return True
+
+    return False
+
+@rules.predicate
+def can_delete_session(user,session):
+    if user.is_anonymous:
+        return False
+
+    if session.sessiontype in ['race','indoorrace']:
+        return False
+
+    if user == session.manager:
+        return True
+
+    return False
+
+
+
+rules.add_perm('plannedsession.add_session',can_add_session)
+rules.add_perm('plannedsession.view_session',can_view_session)
+rules.add_perm('plannedsession.change_session',can_change_session)
+rules.add_perm('plannedsession.delete_session',can_delete_session)
+
+# TEAM (group) permissions
+
+"""
+- These methods exist on team
+    - team.manager
+    - team.private
+
+- These rules apply to a team
+    - A Pro or Plan rower can be manager of only 1 team
+        - test_permissions.PermissionsFreeCoach.test_pro_groupmanager
+        - test_permissions.PermissionsViewTests.test_pro_groups_create
+    - A coach can have any number of teams (as manager)
+        - test_permissions.PermissionsBasicTest.test_coach_groupmanager
+    - Basic user cannot manage a group
+        - test_permissions.PermissionsFreeCoach.test_basic_groupmanager
+    - Basic user cannot join groups led by Free Coach or Pro
+        - test_permissions.PermissionFreeCoach.test_add_basic_pro_or_plan
+    - Basic athletes can be member of Coach led group
+        - test_permissions.PermissionsBasicTest.test_add_coach
+    - Pro users (and higher) can join team led by other Pro (or higher) user
+            - test_permissions.PermissionsFreeCoach.test_add_proplan_pro_or_plan
+            - test_permissions.PermissionsViewTests.test_team_member_request_pro_pro
+            - test_permissions.PermissionsViewTests.test_team_member_request_basic_pro
+    - On downgrade, Coach users lose all but their oldest team (add test!)
+
+"""
+
+# check if user is manager of the team
+@rules.predicate
+def is_team_manager(user,team):
+    return team.manager == user
+
+# check is user is member of team - untested
+@rules.predicate
+def is_team_member(user,team):
+    members = team.rower.all()
+    return user in [member.user for member in members]
+
+# check if user can view team
+@rules.predicate
+def can_view_team(user,team):
+    # user based - below untested
+    if user.rower.rowerplan == 'basic' and team.manager.rower.rowerplan != 'coach':
+        return False
+    # team is public
+    if team.private == 'open':
+        return True
+    # team is private - below untested
+    return is_team_member(user,team) | is_team_manager(user,team)
+
+@rules.predicate
+def can_change_team(user,team):
+    return is_team_manager(user,team)
+
+@rules.predicate
+def can_delete_team(user,team):
+    return is_team_manager(user,team)
+
+@rules.predicate
+def can_join_team(user,team):
+    return is_paid_coach(team.manager) or ispromember(user)
+
+# For Team functionality
+rules.add_perm('teams.view_team',can_view_team)
+rules.add_perm('teams.add_team',user_is_not_basic)
+rules.add_perm('teams.change_team',can_change_team)
+rules.add_perm('teams.delete_team',can_delete_team)
+
+# RACING permissions
+
+"""
+    - VirtualRace
+        - rules to add, view, delete, change
+    - GeoCourse
+        - rules to add, view, delete, change
+    - RaceLogo
+"""
+
+@rules.predicate
+def can_change_course(user,course):
+    if user.is_anonymous:
+        return False
+
+    return course.manager == user.rower
+
+# untested
+@rules.predicate
+def can_delete_course(user,course):
+    if user.is_anonymous:
+        return False
+
+    return course.manager == user.rower
+
+@rules.predicate
+def can_delete_logo(user,logo):
+    if user.is_anonymous:
+        return False
+
+    return logo.user == user
+
+@rules.predicate
+def can_change_race(user,race):
+    if user.is_anonymous:
+        return False
+
+    return race.manager == user
+
+# everybody can view or add a course
+rules.add_perm('course.change_course',can_change_course)
+rules.add_perm('course.delete_course',can_delete_course)
+
+rules.add_perm('racelogo.delete_logo',can_delete_logo)
+
+# everybody can view a race
+rules.add_perm('virtualevent.change_race',can_change_race)
+# can races be deleted?
+
+
+# ANALYSIS permissions
+
+"""
+    - Conditions
+    - Alerts
+        - rules to add, view, delete, change
+    - cpdata
+"""

rowers/runkeeperstuff.py

@@ -7,6 +7,8 @@ from __future__ import unicode_literals, absolute_import
 from rowers.imports import *
 import re
 
+from rowers.rower_rules import is_workout_user
+
 from rowsandall_app.settings import (
     C2_CLIENT_ID, C2_REDIRECT_URI, C2_CLIENT_SECRET,
     STRAVA_CLIENT_ID, STRAVA_REDIRECT_URI, STRAVA_CLIENT_SECRET,
@@ -285,7 +287,7 @@ def workout_runkeeper_upload(user,w):
 
     # ready to upload. Hurray
 
-    if (checkworkoutuser(user,w)):
+    if (is_workout_user(user,w)):
         data = createrunkeeperworkoutdata(w)
         if not data:
             message = "Data error in Runkeeper Upload"

rowers/sporttracksstuff.py

@@ -18,6 +18,7 @@ from rowsandall_app.settings import (
     )
 
 import rowers.mytypes as mytypes
+from rowers.rower_rules import is_workout_user
 
 oauth_data = {
     'client_id': SPORTTRACKS_CLIENT_ID,
@@ -265,7 +266,7 @@ def workout_sporttracks_upload(user,w):
 
     thetoken = sporttracks_open(user)
 
-    if (checkworkoutuser(user,w)):
+    if (is_workout_user(user,w)):
         data = createsporttracksworkoutdata(w)
         if not data:
             message = "Data error"

rowers/stravastuff.py

@@ -18,6 +18,8 @@ queuehigh = django_rq.get_queue('low')
 
 from rowers.dataprep import columndict
 
+from rowers.rower_rules import is_workout_user,ispromember
+
 import stravalib
 from stravalib.exc import ActivityUploadFailed,TimeoutExceeded
 
@@ -123,7 +125,7 @@ def get_strava_workout_list(user,limit_n=0):
 # gets all new Strava workouts for a rower
 def get_strava_workouts(rower):
 
-    if not isprorower(rower):
+    if not ispromember(rower.user):
         return 0
 
     try:
@@ -632,7 +634,7 @@ def workout_strava_upload(user,w):
         s = "Token doesn't exist. Need to authorize"
         raise NoTokenError("Your hovercraft is full of eels")
     else:
-        if (checkworkoutuser(user,w)):
+        if (is_workout_user(user,w)):
             try:
                 tcxfile,tcxmesg = createstravaworkoutdata(w)
                 if tcxfile:

rowers/teams.py

@@ -26,6 +26,8 @@ from rowers.models import (
     CoachingGroup
     )
 
+from rowers.rower_rules import is_team_manager,is_team_member,is_coach
+
 from rowers.tasks import (
     handle_sendemail_invite,
     handle_sendemail_request,
@@ -53,14 +55,15 @@ def handle_remove_workouts_team(ws,t):
     return 1
 
 def handle_add_workouts_team(ws,t):
-    
+
     for w in ws:
         w.team.add(t)
 
     return 1
 
 def update_team(t,name,manager,private,notes,viewing):
-    if t.manager != manager:
+
+    if not is_team_manager(manager,t):
         return (0,'You are not the manager of this team')
     try:
         t.name = name
@@ -78,11 +81,11 @@ def create_team(name,manager,private='open',notes='',viewing='allmembers'):
     if manager.rower.rowerplan == 'basic':
         if manager.rower.protrialexpires < timezone.now().date() and manager.rower.plantrialexpires < timezone.now().date():
             return (0,'You need to upgrade to a paid plan to establish a team')
-    if manager.rower.rowerplan not in ('coach','freecoach'):
+    if not is_coach(manager):
         ts = Team.objects.filter(manager=manager)
         if len(ts)>=1:
             return (0,'You need to upgrade to the Coach plan to have more than one team')
-    
+
     try:
         t = Team(name=name,manager=manager,notes=notes,
                  private=private,viewing=viewing)
@@ -99,24 +102,11 @@ def remove_team(id):
         send_team_delete_mail(t,r)
     return t.delete()
 
-#def set_teamplanexpires(rower):
-#    ts = Team.objects.filter(rower=rower)
-
-#    texp = datetime.date(timezone.now())
-
-#    for t in ts:
-#        print t.name
-#        mr = Rower.objects.get(user=t.manager)
-#        if mr.teamplanexpires > texp:
-#            rower.teamplanexpires = mr.teamplanexpires
-
-#        t.save()
-
     return (1,'Updated rower team expiry')
 
 def add_coach(coach,rower):
     # get coaching group
-    
+
     coachgroup = coach.mycoachgroup
     if coachgroup is None:
         coachgroup = CoachingGroup(name=coach.user.first_name)
@@ -126,7 +116,7 @@ def add_coach(coach,rower):
 
     if get_coach_club_size(coach)<coach.clubsize:
         rower.coachinggroups.add(coach.mycoachgroup)
-        
+
         return (1,"Added Coach")
     else:
         return (0,"Maximum number of athletes reached")
@@ -137,14 +127,14 @@ def add_member(id,rower):
         rower.team.add(t)
     except ValidationError as e:
         return(0,"Couldn't add member: "+str(e.message))
-        
+
     # code to add all workouts
     ws = Workout.objects.filter(user=rower)
-    
+
     res = handle_add_workouts_team(ws,t)
 
 #    set_teamplanexpires(rower)
-        
+
     return (id,'Member added')
 
 def remove_member(id,rower):
@@ -154,7 +144,7 @@ def remove_member(id,rower):
     ws = Workout.objects.filter(user=rower,team=t)
 
     res = handle_remove_workouts_team(ws,t)
-            
+
 #    set_teamplanexpires(rower)
     return (id,'Member removed')
 
@@ -166,7 +156,7 @@ def remove_coach(coach,rower):
         coachgroup.save()
         coach.mycoachgroup = coachgroup
         coach.save()
-        
+
     rower.coachinggroups.remove(coachgroup)
 
     return (1,'Coach removed')
@@ -179,24 +169,19 @@ def rower_get_managers(rower):
     return managers
 
 def rower_get_coaches(rower):
-    coaches = []
-    for group in rower.coachinggroups.all():
-        try:
-            coach = Rower.objects.get(mycoachgroup=group)
-            coaches.append(coach)
-        except Rower.DoesNotExist:
-            pass
+    return rower.get_coaches()
 
-    return coaches
-    
 
 def coach_getcoachees(coach):
-    if coach.mycoachgroup and coach.rowerplan in ('coach','freecoach'):
-        return Rower.objects.filter(
+    rowers = []
+    if coach.mycoachgroup and is_coach(coach.user):
+        rs =  Rower.objects.filter(
             coachinggroups__in=[coach.mycoachgroup]
         ).distinct().order_by("user__last_name","user__first_name")
-    else:
-        return []
+        for r in rs:
+            rowers.append(r)
+
+    return rowers
 
 def coach_remove_athlete(coach,rower):
     try:
@@ -206,14 +191,14 @@ def coach_remove_athlete(coach,rower):
         coachgroup.save()
         coach.mycoachgroup = coachgroup
         coach.save()
-        
+
     rower.coachinggroups.remove(coachgroup)
 
     return (1,'Coach removed')
 
 def mgr_remove_member(id,manager,rower):
     t = Team.objects.get(id=id)
-    if t.manager == manager:
+    if is_team_manager(manager,t):
         remove_member(id,rower)
         send_email_member_dropped(id,rower)
         return (id,'Member removed')
@@ -270,7 +255,7 @@ def send_coachrequest_email(rekwest):
     res = myqueue(queuehigh,
                   handle_sendemail_coachrequest,
                   email,name,code,coachname)
-        
+
 def send_coacheerequest_email(rekwest):
     name = rekwest.user.first_name + " " + rekwest.user.last_name
     email = rekwest.user.email
@@ -282,7 +267,7 @@ def send_coacheerequest_email(rekwest):
     res = myqueue(queuehigh,
                   handle_sendemail_coacheerequest,
                   email,name,code,coachname)
-        
+
 def create_request(team,user):
     r2 = Rower.objects.get(user=user)
     r = Rower.objects.get(user=team.manager)
@@ -299,11 +284,11 @@ def create_request(team,user):
     u = User.objects.get(id=user)
     rekwest = TeamRequest(team=team,user=u,code=code)
     rekwest.save()
-    
+
     send_request_email(rekwest)
-        
+
     return (rekwest.id,'The request was created')
-    
+
     return (0,'Something went wrong in create_request')
 
 def get_coach_club_size(coach):
@@ -341,11 +326,11 @@ def create_coaching_offer(coach,user):
         return (0,'You are not a coach')
 
 
-    
+
 
 def create_invite(team,manager,user=None,email=''):
     r = Rower.objects.get(user=manager)
-    if team.manager != manager:
+    if not is_team_manager(manager,team):
         return (0,'Not the team manager')
     if user:
         try:
@@ -365,7 +350,7 @@ def create_invite(team,manager,user=None,email=''):
             user=None
         except Rower.MultipleObjectsReturned:
             return (0,'There is more than one user with that email address')
-            
+
     #    if count_club_members(team.manager)+count_invites(team.manager) <= r.clubsize:
     codes = [i.code for i in TeamInvite.objects.all()]
     code = uuid.uuid4().hex[:10].upper()
@@ -376,8 +361,8 @@ def create_invite(team,manager,user=None,email=''):
     invite = TeamInvite(team=team,code=code,user=user,email=email)
     invite.save()
     return (invite.id,'Invitation created')
-        
-        
+
+
     return (0,'Nothing done')
 
 def revoke_request(user,id):
@@ -402,7 +387,7 @@ def reject_revoke_coach_offer(user,id):
 
     if rekwest.coach.user == user:
         rekwest.delete()
-        
+
         return (1,'Request removed')
     elif rekwest.user == user:
         send_coachoffer_rejected_email(rekwest)
@@ -410,7 +395,7 @@ def reject_revoke_coach_offer(user,id):
         return (1,'Request removed')
     else:
         return (0,'Not permitted')
-    
+
 def reject_revoke_coach_request(user,id):
     try:
         rekwest = CoachRequest.objects.get(id=id)
@@ -433,26 +418,26 @@ def revoke_invite(manager,id):
     except TeamInvite.DoesNotExist:
         return (0,'The invitation is invalid')
 
-    if invite.team.manager==manager:
+    if is_team_manager(manager,invite.team):
         invite.delete()
         return (1,'Invitation revoked')
     else:
         return (0,'You are not the team manager')
-    
+
 def reject_request(manager,id):
     try:
         rekwest = TeamRequest.objects.get(id=id)
     except TeamRequest.DoesNotExist:
         return (0,'The request is invalid')
 
-    if rekwest.team.manager==manager:
+    if is_team_manager(manager,rekwest.team):
         send_request_reject_email(rekwest)
         rekwest.delete()
         return (1,'Request rejected')
     else:
         return (0,'You are not the manager for this request')
 
-    
+
 def reject_invitation(user,id):
     try:
         invite = TeamInvite.objects.get(id=id)
@@ -472,14 +457,14 @@ def send_invite_email(id):
         invitation = TeamInvite.objects.get(id=id)
     except TeamInvite.DoesNotExist:
         return (0,'Invitation doesn not exist')
-        
+
     if invitation.user:
         email = invitation.user.email
         name = invitation.user.first_name + " " + invitation.user.last_name
     else:
         email = invitation.email
         name = ''
-        
+
     code = invitation.code
     teamname = invitation.team.name
     manager = invitation.team.manager.first_name+' '+invitation.team.manager.last_name
@@ -514,7 +499,7 @@ def send_email_member_dropped(teamid,rower):
 	          email,name,teamname,manager)
 
     return (1,'Member dropped email sent')
-    
+
 
 def send_request_accept_email(rekwest):
     id = rekwest.id
@@ -527,7 +512,7 @@ def send_request_accept_email(rekwest):
 	          email,name,teamname,manager)
 
     return (1,'Invitation email sent')
-    
+
 
 def send_request_reject_email(rekwest):
     id = rekwest.id
@@ -606,7 +591,7 @@ def send_request_email(rekwest):
 
 def process_request_code(manager,code):
     code = code.upper()
-    
+
     try:
         rekwest = TeamRequest.objects.get(code=code)
     except TeamRequest.DoesNotExist:
@@ -622,10 +607,10 @@ def process_request_code(manager,code):
     if not result:
         return (result,"The member couldn't be added")
 
-    
+
     send_request_accept_email(rekwest)
-            
-        
+
+
     rekwest.delete()
     return (result,'The member was added')
 
@@ -641,7 +626,7 @@ def process_invite_code(user,code):
     if nu > invitation.issuedate+timedelta(days=inviteduration):
         revoke_invite(invitation.team.manager,invitation.id)
         return (0,'The invitation has expired')
-    
+
     t = invitation.team
     result, comment = add_member(t.id,r)
     if not result:
@@ -698,7 +683,7 @@ def process_coachoffer_code(user,code):
         return result
     else:
         send_coachoffer_accepted_email(rekwest)
-        
+
     rekwest.delete()
 
     return result
@@ -732,7 +717,7 @@ def send_coachrequest_accepted_email(rekwest):
     res = myqueue(queuehigh,
                   handle_sendemail_coachrequest_accepted,
                   email,coachname,name)
-    
+
 
 def send_coachoffer_accepted_email(rekwest):
     coachname = rekwest.coach.user.first_name + " " + rekwest.coach.user.last_name
@@ -743,5 +728,3 @@ def send_coachoffer_accepted_email(rekwest):
     res = myqueue(queuehigh,
                   handle_sendemail_coachoffer_accepted,
                   coachemail,coachname,name)
-
-    

rowers/templates/menu_other.html

@@ -14,7 +14,7 @@
     {% else %}
     <a href="/rowers/team-compare-select/team/0/"><i class="fas fa-balance-scale fa-fw"></i>&nbsp;Compare</a>
     {% endif %}
-  </li>  
+  </li>
   <li>
     <a href="/rowers/workout/upload/"><i class="fas fa-file-upload fa-fw"></i>&nbsp;Upload</a>
   </li>
@@ -33,7 +33,7 @@
   <li class="has-children" id="imports">
     <input type="checkbox" name ="group-1" id="group-1">
     <label for="group-1"><i class="fas fa-cloud-download fa-fw"></i>&nbsp;Import</label>
-    
+
     <ul>
       <li id="concept2"><a href="/rowers/workout/c2list/">Concept2</a></li>
       <li id="strava"><a href="/rowers/workout/stravaimport/">Strava</a></li>
@@ -46,6 +46,4 @@
 </ul> <!-- cd-accordion-menu -->
 
 
-
-
 {% include 'menuscript.html' %}

rowers/templates/menu_profile.html

@@ -44,13 +44,13 @@
 
 {% if user.is_authenticated and user|is_manager and rower %}
 <p>&nbsp;</p>
-{% if user|coach_rowers %}
+{% if request.user|coach_rowers %}
 <ul class="cd-accordion-menu animated">
   <li class="has-children" id="athletes">
     <input type="checkbox" name="athlete-selector" id="athlete-selector">
     <label for="athlete-selector"><i class="fas fa-users fa-fw"></i>&nbsp;Athletes</label>
     <ul>
-      {% for member in user|coach_rowers %}
+      {% for member in request.user|coach_rowers %}
       <a href={{ request.path|userurl:member.user }}>
         <i class="fas fa-user fa-fw"></i>
         {% if member.user == rower.user %}

rowers/templates/plannedsessioncreate.html

@@ -130,7 +130,7 @@
 						<a class="small" href="/rowers/sessions/{{ ps.id }}/templateedit/">Edit Template</a>
 					</td>
           <td>
-            <a class="small" href="/rowers/sessions/{{ ps.id }}/deleteconfirm/">Delete</a>
+            <a class="small" href="/rowers/sessions/{{ ps.id }}/deleteconfirm/?next={{ request.path|urlencode }}">Delete</a>
           </td>
 	</tr>
 	{% endfor %}

rowers/templatetags/rowerfilters.py

@@ -21,7 +21,7 @@ from rowers.plannedsessions import (
 from rowers import c2stuff, runkeeperstuff
 from rowers.c2stuff import c2_open
 from rowers.runkeeperstuff import runkeeper_open
-from rowers.models import checkaccessuser
+from rowers.rower_rules import is_coach_user, is_workout_user, isplanmember,ispromember
 from rowers.mytypes import otwtypes
 from rowers.utils import NoTokenError
 
@@ -385,14 +385,13 @@ def is_session_manager(id,user):
 
     return ps.manager == user
 
-from rowers.models import checkworkoutuser
 
 @register.filter
 def may_edit(workout,request):
     mayedit = 0
     if request.user == workout.user.user:
         mayedit = True
-    if checkworkoutuser(request.user,workout):
+    if is_workout_user(request.user,workout):
         mayedit = True
 
     return mayedit
@@ -413,7 +412,7 @@ def mayeditplan(obj,request):
             return request.user == obj.manager.user
 
     rr = Rower.objects.get(user=request.user)
-    if checkaccessuser(request.user,obj.rower) and rr.rowerplan not in ['basic','pro']:
+    if is_coach_user(request.user,obj.rower) and rr.rowerplan not in ['basic','pro']:
         mayedit = True
 
 
@@ -431,7 +430,7 @@ def get_field_id(id,s,form):
 
 from rowers.models import Rower,Team,TrainingPlan,TrainingTarget
 
-from rowers.views import ispromember
+
 @register.filter
 def is_promember(user):
     return ispromember(user)
@@ -441,10 +440,10 @@ def is_manager(user):
     r = Rower.objects.get(user=user)
     return 'coach' in r.rowerplan
 
-from rowers.views import hasplannedsessions
+
 @register.filter
 def is_planmember(user):
-    return hasplannedsessions(user)
+    return isplanmember(user)
 
 @register.filter
 def get_age(r):

rowers/tests/.~lock.viewnames.csv#

@@ -1 +0,0 @@
-,sander,sander-pc,25.01.2020 09:37,file:///home/sander/.config/libreoffice/4;

rowers/tests/mocks.py

@@ -18,7 +18,7 @@ from django.test import TestCase, Client,override_settings
 from django.core.management import call_command
 from django.utils.six import StringIO
 from django.test.client import RequestFactory
-from rowers.views import checkworkoutuser,c2_open
+from rowers.views import c2_open
 from rowers.models import Workout, User, Rower, WorkoutForm,RowerForm,GraphImage
 from rowers.forms import DocumentsForm,CNsummaryForm,RegistrationFormUniqueEmail
 import rowers.plots as plots
@@ -69,6 +69,10 @@ def mocked_myqueue(*args, **kwargs):
 
     return Job()
 
+def mock_c2open(*args, **kwargs):
+    print('mock')
+    return('aap')
+
 def mocked_sqlalchemy(*args, **kwargs):
     # return object with method
 
@@ -606,6 +610,7 @@ def mocked_requests(*args, **kwargs):
         def __init__(self, json_data, status_code):
             self.json_data = json_data
             self.status_code = status_code
+            self.ok = True
 
         def json(self):
             return self.json_data

rowers/tests/statements.py

@@ -7,12 +7,12 @@ try:
     FileNotFoundError
 except NameError:
     FileNotFoundError = None
-    
+
 try:
     OSError
 except NameError:
     OSError = None
-    
+
 import pytest
 
 pytestmark = pytest.mark.django_db
@@ -26,7 +26,7 @@ from django.core.management import call_command
 from django.core.files.uploadedfile import SimpleUploadedFile
 from django.utils.six import StringIO
 from django.test.client import RequestFactory
-from rowers.views import checkworkoutuser,c2_open, multi_compare_view
+from rowers.views import c2_open, multi_compare_view
 
 from rowers.forms import (
     DocumentsForm,CNsummaryForm,RegistrationFormUniqueEmail,
@@ -101,22 +101,22 @@ def get_random_file(filename='rowers/tests/testdata/testdata.csv',name=''):
         fromstring = 'test_%s_' % mod.__name__
     except AttributeError:
         fromstring = 'none_'
-        
+
     row = rdata(filename)
     totaldist = row.df['cum_dist'].max()
     totaltime = row.df['TimeStamp (sec)'].max()-row.df['TimeStamp (sec)'].min()
     totaltime = totaltime+row.df.loc[row.df.index[0],' ElapsedTime (sec)']
-    
-	
+
+
     hours = int(totaltime/3600.)
 
     minutes = int((totaltime - 3600.*hours)/60.)
     seconds = int(totaltime - 3600.*hours - 60.*minutes)
     tenths = int(10*(totaltime - 3600.*hours - 60.*minutes - seconds))
-    
+
     duration = "%s:%s:%s.%s" % (hours,minutes,seconds,tenths)
     duration = datetime.time(hour=hours,minute=minutes,second=seconds)
-    
+
     workoutdate = row.rowdatetime.date()
     workoutstarttime = row.rowdatetime
 
@@ -139,7 +139,7 @@ def get_random_file(filename='rowers/tests/testdata/testdata.csv',name=''):
         'duration':duration,
         'totaldist':totaldist,
         }
-    
+
     return thedict
 
 class UserFactory(factory.DjangoModelFactory):
@@ -168,11 +168,11 @@ class RaceFactory(factory.DjangoModelFactory):
     sessiontype = 'indoorrace'
     sessionvalue = 1
     sessionmode = 'time'
-    
+
 class WorkoutFactory(factory.DjangoModelFactory):
     class Meta:
         model = Workout
-        
+
     name = factory.LazyAttribute(lambda _: faker.word())
     notes = faker.text()
     startdatetime = get_random_file(name=faker.word())['startdatetime']
@@ -220,5 +220,3 @@ def cleanup(request):
 
 
     request.addfinalizer(remove_test_files)
-        
-

rowers/tests/test_aworkouts.py

@@ -242,9 +242,9 @@ class WorkoutViewTest(TestCase):
 
     @patch('rowers.dataprep.create_engine')
     @patch('rowers.dataprep.getsmallrowdata_db')
-    #    @patch('rowers.weather.requests.get', side_effect=mocked_requests)
+    @patch('rowers.weather.requests.get', side_effect=mocked_requests)
     def test_waterworkout_view(self,
-                               mocked_sqlalchemy, mocked_getsmallrowdata_db):
+                               mocked_sqlalchemy, mocked_getsmallrowdata_db, mocked_requests):
         login = self.c.login(username=self.u.username, password=self.password)
         self.assertTrue(login)
 

rowers/tests/test_basicrower.py

@@ -20,6 +20,8 @@ class SimpleViewTest(TestCase):
                                       birthdate=faker.profile()['birthdate'],
                                       gdproptin=True,surveydone=True,
                                       gdproptindate=timezone.now(),
+                                      protrialexpires=datetime.date(1970,1,1),
+                                      plantrialexpires=datetime.date(1970,1,1),
                                       rowerplan='basic')
 
         self.c = Client()

rowers/tests/test_misc.py

@@ -8,7 +8,7 @@ from .statements import *
 
 nu = datetime.datetime.now()
 
-
+from rowers.rower_rules import is_workout_user
 
 #@pytest.mark.django_db
 class WorkoutTests(TestCase):
@@ -28,7 +28,7 @@ class WorkoutTests(TestCase):
                                    duration="0:55:00",distance=8000)
 
     def test_checkworkoutuser(self):
-        self.assertEqual(checkworkoutuser(self.u,self.w),True)
+        self.assertEqual(is_workout_user(self.u,self.w),True)
 
 #@pytest.mark.django_db
 class C2Tests(TestCase):

rowers/tests/test_permissions.py

@@ -13,6 +13,87 @@ from django.db import transaction
 
 import rowers.teams as teams
 import rowers.plannedsessions as plannedsessions
+from rowers.rower_rules import is_coach_user
+
+@override_settings(TESTING=True)
+class PlanningPermissionsCoach(TestCase):
+    def setUp(self):
+        self.c = Client()
+
+        self.ucoach = UserFactory()
+        self.rcoach = Rower.objects.create(
+            user=self.ucoach,
+            birthdate=faker.profile()['birthdate'],
+            gdproptin=True,surveydone=True,
+            gdproptindate=timezone.now(),
+            rowerplan='coach',
+            clubsize=10,
+        )
+        self.ucoachpassword = faker.word()
+        self.ucoach.set_password(self.ucoachpassword)
+        self.ucoach.save()
+
+        self.ucoachee = UserFactory()
+        self.rcoachee = Rower.objects.create(
+            user=self.ucoachee,
+            birthdate=faker.profile()['birthdate'],
+            gdproptin=True,surveydone=True,
+            gdproptindate=timezone.now(),
+            rowerplan='basic'
+        )
+
+        self.coachgroup = CoachingGroup.objects.create(name=self.ucoach.first_name)
+        self.rcoach.mycoachgroup = self.coachgroup
+        self.rcoach.save()
+
+        self.team = Team.objects.create(
+            name=faker.word()+'3',
+            notes=faker.text(),
+            manager=self.ucoach)
+
+        # coachee is in coach's team
+        self.rcoachee.team.add(self.team)
+
+        # coachee is coached by coach
+        self.rcoachee.coachinggroups.add(self.rcoach.mycoachgroup)
+        self.rcoachee.save()
+
+        self.ugroupmember = UserFactory()
+        self.rgroupmember = Rower.objects.create(
+            user=self.ugroupmember,
+            birthdate=faker.profile()['birthdate'],
+            gdproptin=True,surveydone=True,
+            gdproptindate=timezone.now(),
+            rowerplan='basic'
+        )
+
+        # groupmember is in coach's team (but not coached)
+        self.rgroupmember.team.add(self.team)
+
+
+    # def test_target(self):
+
+    def test_trainingplan(self):
+        plan = TrainingPlan(
+            name='test plan',
+            manager=self.ucoach.rower,
+        )
+        plan.save()
+
+        # can add self and coachee
+        plan.rowers.add(self.ucoach.rower)
+        plan.rowers.add(self.ucoachee.rower)
+
+        # test 1
+        athletes = plan.rowers.all()
+        self.assertTrue(self.ucoach.rower in athletes)
+        self.assertTrue(self.ucoachee.rower in athletes)
+
+        # can add groupmember if not basic
+        plan.rowers.add(self.rgroupmember)
+        athletes = plan.rowers.all()
+        self.assertTrue(self.rgroupmember in athletes)
+
 
 @override_settings(TESTING=True)
 class PermissionsFreeCoach(TestCase):
@@ -528,6 +609,8 @@ class PermissionsViewTests(TestCase):
                                       rowerplan='basic')
 
         self.ubasic_workouts = WorkoutFactory.create_batch(5, user=self.rbasic)
+        self.ubasic_workouts[0].privacy == 'private'
+
         self.factory = RequestFactory()
         self.ubasicpassword = faker.word()
         self.ubasic.set_password(self.ubasicpassword)
@@ -553,6 +636,24 @@ class PermissionsViewTests(TestCase):
             manager=self.ucoach)
 
 
+    ## only ubasic can view ubasic_workouts[0] which is private
+    def test_view_workout(self):
+        login = self.c.login(username=self.ucoach.username, password=self.ucoachpassword)
+        self.assertTrue(login)
+
+        url = reverse('workout_view',
+                      kwargs={'id':self.ubasic_workouts[0].id})
+        response = self.c.get(url)
+        self.assertTrue(response.status_code,403)
+
+        login = self.c.login(username=self.ubasic.username, password=self.ubasicpassword)
+        self.assertTrue(login)
+
+        url = reverse('workout_view',
+                      kwargs={'id':self.ubasic_workouts[0].id})
+        response = self.c.get(url)
+        self.assertTrue(response.status_code,200)
+
     ## Coach can have any number of groups
     def test_coach_groups_create(self):
         login = self.c.login(username=self.ucoach.username, password=self.ucoachpassword)
@@ -644,7 +745,8 @@ class PermissionsViewTests(TestCase):
 
 
     ## Coach can edit on behalf of athlete if permitted
-    def test_coach_edit_athlete_settings(self):
+    # 1, Preferences
+    def test_coach_edit_athlete_prefs(self):
         self.rbasic.team.add(self.teamcoach)
         self.rbasic.coachinggroups.add(self.coachinggroup)
 
@@ -656,7 +758,7 @@ class PermissionsViewTests(TestCase):
         response = self.c.get(url)
         self.assertEqual(response.status_code,200)
 
-    def test_coach_edit_athlete_settings_not(self):
+    def test_coach_edit_athlete_prefs_not(self):
         self.rbasic.team.add(self.teamcoach)
 
         login = self.c.login(username=self.ucoach.username, password=self.ucoachpassword)
@@ -667,6 +769,78 @@ class PermissionsViewTests(TestCase):
         response = self.c.get(url)
         self.assertEqual(response.status_code,403)
 
+    # 2, Favorite Charts
+    def test_coach_edit_athlete_settings(self):
+        self.rbasic.team.add(self.teamcoach)
+        self.rbasic.coachinggroups.add(self.coachinggroup)
+
+        login = self.c.login(username=self.ucoach.username, password=self.ucoachpassword)
+        self.assertTrue(login)
+
+        url = reverse('rower_favoritecharts_view',kwargs={'userid':self.ubasic.id})
+
+        response = self.c.get(url)
+        self.assertEqual(response.status_code,200)
+
+    def test_coach_edit_athlete_settings_not(self):
+        self.rbasic.team.add(self.teamcoach)
+
+        login = self.c.login(username=self.ucoach.username, password=self.ucoachpassword)
+        self.assertTrue(login)
+
+        url = reverse('rower_favoritecharts_view',kwargs={'userid':self.ubasic.id})
+
+        response = self.c.get(url)
+        self.assertEqual(response.status_code,403)
+
+    # 3, Export Settings
+    def test_coach_edit_athlete_exportsettings(self):
+        self.rbasic.team.add(self.teamcoach)
+        self.rbasic.coachinggroups.add(self.coachinggroup)
+
+        login = self.c.login(username=self.ucoach.username, password=self.ucoachpassword)
+        self.assertTrue(login)
+
+        url = reverse('rower_exportsettings_view',kwargs={'userid':self.ubasic.id})
+
+        response = self.c.get(url)
+        self.assertEqual(response.status_code,200)
+
+    def test_coach_edit_athlete_exportsettings_not(self):
+        self.rbasic.team.add(self.teamcoach)
+
+        login = self.c.login(username=self.ucoach.username, password=self.ucoachpassword)
+        self.assertTrue(login)
+
+        url = reverse('rower_exportsettings_view',kwargs={'userid':self.ubasic.id})
+
+        response = self.c.get(url)
+        self.assertEqual(response.status_code,403)
+
+    # 4, Account settings
+    def test_coach_edit_athlete_account(self):
+        self.rbasic.team.add(self.teamcoach)
+        self.rbasic.coachinggroups.add(self.coachinggroup)
+
+        login = self.c.login(username=self.ucoach.username, password=self.ucoachpassword)
+        self.assertTrue(login)
+
+        url = reverse('rower_edit_view',kwargs={'userid':self.ubasic.id})
+
+        response = self.c.get(url)
+        self.assertEqual(response.status_code,200)
+
+    def test_coach_edit_athlete_account_not(self):
+        self.rbasic.team.add(self.teamcoach)
+
+        login = self.c.login(username=self.ucoach.username, password=self.ucoachpassword)
+        self.assertTrue(login)
+
+        url = reverse('rower_edit_view',kwargs={'userid':self.ubasic.id})
+
+        response = self.c.get(url)
+        self.assertEqual(response.status_code,403)
+
     ## Coach can run analytics for athlete
     @patch('rowers.dataprep.read_cols_df_sql', side_effect = mocked_read_df_cols_sql_multistats)
     def test_coach_edit_athlete_analysis(self,mocked_df):
@@ -679,7 +853,7 @@ class PermissionsViewTests(TestCase):
 
         url = reverse('cumstats',
                       kwargs={
-                          'theuser':self.ubasic.id,
+                          'userid':self.ubasic.id,
                       }
         )
 
@@ -687,6 +861,8 @@ class PermissionsViewTests(TestCase):
 
         self.assertEqual(response.status_code,200)
 
+
+
     @patch('rowers.dataprep.read_cols_df_sql', side_effect = mocked_read_df_cols_sql_multistats)
     def test_coach_edit_athlete_analysis_not(self,mocked_df):
         self.rbasic.team.add(self.teamcoach)
@@ -697,7 +873,7 @@ class PermissionsViewTests(TestCase):
 
         url = reverse('cumstats',
                       kwargs={
-                          'theuser':self.ubasic.id,
+                          'userid':self.ubasic.id,
                       }
         )
 
@@ -705,6 +881,24 @@ class PermissionsViewTests(TestCase):
 
         self.assertEqual(response.status_code,403)
 
+    @patch('rowers.dataprep.read_cols_df_sql', side_effect = mocked_read_df_cols_sql_multistats)
+    def test_coach_edit_athlete_analysis_not2(self,mocked_df):
+        self.rbasic.team.add(self.teamcoach)
+
+        login = self.c.login(username=self.ucoach.username, password=self.ucoachpassword)
+        self.assertTrue(login)
+
+
+        url = reverse('analysis_new',
+                  kwargs={
+                      'userid':self.ubasic.id,
+                  }
+                 )
+
+        response = self.c.get(url)
+
+        self.assertEqual(response.status_code,403)
+
 
     ## Coach can upload on behalf of athlete - if team allows
     @patch('rowers.dataprep.create_engine')
@@ -810,6 +1004,32 @@ class PermissionsViewTests(TestCase):
         response = self.c.get(url)
         self.assertEqual(response.status_code,403)
 
+    ## Coach can see list of workouts of athlete
+    def test_coach_athlete_workout_list(self):
+        self.rbasic.team.add(self.teamcoach)
+
+        login = self.c.login(username=self.ucoach.username, password=self.ucoachpassword)
+        self.assertTrue(login)
+
+        url = reverse('workouts_view',
+                      kwargs={'rowerid':self.rbasic.id})
+
+
+
+        response = self.c.get(url)
+        self.assertEqual(response.status_code,200)
+
+        url = reverse('workouts_view',
+                      kwargs={'userid':self.ubasic.id})
+
+        response = self.c.get(url)
+        self.assertEqual(response.status_code,200)
+
+        url = reverse('workouts_view')
+
+        response = self.c.get(url)
+        self.assertEqual(response.status_code,200)
+
     ## Self coach can create one group
     ## Self coach cannot create more than one group
     def test_plan_groups_create(self):
@@ -857,7 +1077,7 @@ class PermissionsViewTests(TestCase):
 
         self.assertTrue(form.is_valid())
 
-        expected_url = reverse('paidplans')
+        expected_url = reverse('paidplans_view')
 
         response = self.c.post(url,form_data,follow=True)
         self.assertRedirects(response,
@@ -924,7 +1144,7 @@ class PermissionsViewTests(TestCase):
 
         url = reverse('cumstats',
                       kwargs={
-                          'theuser':self.ubasic.id,
+                          'userid':self.ubasic.id,
                       }
         )
 
@@ -994,7 +1214,7 @@ class PermissionsViewTests(TestCase):
 
         self.assertTrue(form.is_valid())
 
-        expected_url = reverse('paidplans')
+        expected_url = reverse('paidplans_view')
 
         response = self.c.post(url,form_data,follow=True)
         self.assertRedirects(response,
@@ -1016,7 +1236,7 @@ class PermissionsViewTests(TestCase):
         response = self.c.get(url,follow=True)
         self.assertEqual(response.status_code,200)
 
-        expected_url = reverse('paidplans')
+        expected_url = reverse('paidplans_view')
 
         self.assertRedirects(response,
                         expected_url=expected_url,
@@ -1038,21 +1258,22 @@ class PermissionsViewTests(TestCase):
     ## Pro cannot run analytics on behalf of athlete
     @patch('rowers.dataprep.read_cols_df_sql', side_effect = mocked_read_df_cols_sql_multistats)
     def test_pro_edit_athlete_analysis(self,mocked_df):
-        self.rpro.team.add(self.teampro)
+        with transaction.atomic():
+            self.rpro.team.add(self.teampro)
 
-        login = self.c.login(username=self.upro2.username, password=self.upro2password)
-        self.assertTrue(login)
+            login = self.c.login(username=self.upro2.username, password=self.upro2password)
+            self.assertTrue(login)
 
 
-        url = reverse('cumstats',
-                      kwargs={
-                          'theuser':self.ubasic.id,
-                      }
-        )
+            url = reverse('cumstats',
+                        kwargs={
+                            'userid':self.ubasic.id,
+                            }
+                            )
 
-        response = self.c.get(url)
+            response = self.c.get(url)
 
-        self.assertEqual(response.status_code,403)
+            self.assertEqual(response.status_code,403)
 
     ## Self Coach cannot upload on behalf of athlete
     @patch('rowers.dataprep.create_engine')
@@ -1068,7 +1289,7 @@ class PermissionsViewTests(TestCase):
         response = self.c.get(url,follow=True)
         self.assertEqual(response.status_code,200)
 
-        expected_url = reverse('paidplans')
+        expected_url = reverse('paidplans_view')
         self.assertRedirects(response,
                              expected_url = expected_url,
                              status_code=302,target_status_code=200)
@@ -1180,7 +1401,7 @@ class PermissionsViewTests(TestCase):
         response = self.c.get(url,follow=True)
         self.assertEqual(response.status_code,200)
 
-        expected_url = reverse('team_view',kwargs={'id':self.teampro.id})
+        expected_url = reverse('team_view',kwargs={'team_id':self.teampro.id})
 
         self.assertRedirects(response,
                              expected_url = expected_url,
@@ -1200,7 +1421,7 @@ class PermissionsViewTests(TestCase):
         response = self.c.get(url,follow=True)
         self.assertEqual(response.status_code,200)
 
-        expected_url = reverse('paidplans')
+        expected_url = reverse('paidplans_view')
         self.assertRedirects(response,
                              expected_url = expected_url,
                              status_code=302,target_status_code=200)

rowers/tests/test_permissions2.py

@@ -0,0 +1,501 @@
+from .statements import *
+
+viewstotest = [
+    ('workout_view',
+        {
+        'anonymous': True,
+        'anonymous_response':200,
+        'own': 'basic',
+        'own_response': 200,
+        'own_nonperm': 302,
+        'member': 'basic',
+        'member_response': 200,
+        'member_nonperm': 404,
+        'coachee': 'coach',
+        'coachee_response': 200,
+        'coachee_nonperm': 404,
+        'is_staff': False,
+        'workoutid': True,
+        'userid': False,
+        'dotest': True,
+        }
+        ),
+]
+
+import pandas as pd
+df = pd.read_csv('./rowers/tests/viewnames.csv')
+
+for id, row in df.iterrows():
+    view = row['view']
+    tpl = (view,
+           {
+           'anonymous':row.anonymous,
+           'anonymous_response':row.anonymous_response,
+           'own': row.own,
+           'own_response':row.own_response,
+           'own_nonperm': row.own_nonperm,
+           'member': row.member,
+           'member_response':row.member_response,
+           'member_nonperm': row.member_nonperm,
+           'coachee': row.coachee,
+           'coachee_response':row.coachee_response,
+           'coachee_nonperm': row.coachee_nonperm,
+           'is_staff':row.is_staff,
+           'workoutid':row.workoutid,
+           'userid':row.userid,
+           'dotest':row.dotest,
+           })
+    if row.dotest:
+        viewstotest.append(tpl)
+
+
+plans = ['basic','plan','coach','pro']
+
+@override_settings(TESTING=True)
+class PermissionsViewTests(TestCase):
+    def setUp(self):
+        self.c = Client()
+        ## Users - Pro, Basic, Coach & Self Coach
+
+        ucoach = UserFactory(username='coachuser')
+        rcoach = Rower.objects.create(user=ucoach,
+                                      birthdate=faker.profile()['birthdate'],
+                                      gdproptin=True,surveydone=True,gdproptindate=timezone.now(),
+                                           rowerplan='coach',clubsize=10)
+
+        ucoach_workouts = WorkoutFactory.create_batch(5, user=rcoach)
+        coachinggroup = CoachingGroup.objects.create()
+        rcoach.mycoachgroup = coachinggroup
+        rcoach.save()
+
+        ucoachpassword = faker.word()
+        ucoach.set_password(ucoachpassword)
+        ucoach.save()
+
+        self.ucoach = {
+            'user': ucoach,
+            'password': ucoachpassword,
+            'username': ucoach.username,
+            'workouts': ucoach_workouts,
+        }
+
+        uplan = UserFactory(username='planuser')
+        rplan = Rower.objects.create(user=uplan,
+                                      birthdate=faker.profile()['birthdate'],
+                                      gdproptin=True,surveydone=True,gdproptindate=timezone.now(),
+                                           rowerplan='plan',clubsize=10)
+
+        uplan_workouts = WorkoutFactory.create_batch(5, user=rplan)
+        rcoach.save()
+
+        uplanpassword = faker.word()
+        uplan.set_password(uplanpassword)
+        uplan.save()
+
+        self.uplan = {
+            'user': uplan,
+            'password': uplanpassword,
+            'username': uplan.username,
+            'workouts': uplan_workouts,
+        }
+
+        uplan2 = UserFactory(username='plan2user')
+        rplan2 = Rower.objects.create(user=uplan2,
+                                      birthdate=faker.profile()['birthdate'],
+                                      gdproptin=True,surveydone=True,gdproptindate=timezone.now(),
+                                           rowerplan='plan',clubsize=10)
+
+        uplan2_workouts = WorkoutFactory.create_batch(5, user=rplan2)
+        rcoach.save()
+
+        uplan2password = faker.word()
+        uplan2.set_password(uplan2password)
+        uplan2.save()
+
+        self.uplan2 = {
+            'user': uplan2,
+            'password': uplan2password,
+            'username': uplan2.username,
+            'workouts': uplan2_workouts,
+        }
+
+        upro = UserFactory(username='prouser')
+        rpro = Rower.objects.create(user=upro,
+                                      birthdate=faker.profile()['birthdate'],
+                                      gdproptin=True,surveydone=True,gdproptindate=timezone.now(),
+                                           rowerplan='pro',clubsize=10)
+
+        upro_workouts = WorkoutFactory.create_batch(5, user=rpro)
+        rcoach.save()
+
+        upropassword = faker.word()
+        upro.set_password(upropassword)
+        upro.save()
+
+        self.upro = {
+            'user': upro,
+            'password': upropassword,
+            'username': upro.username,
+            'workouts': upro_workouts,
+        }
+
+        ubasic = UserFactory(username='basicuser')
+        rbasic = Rower.objects.create(user=ubasic,
+                                      birthdate=faker.profile()['birthdate'],
+                                      gdproptin=True,surveydone=True,gdproptindate=timezone.now(),
+                                           rowerplan='basic',clubsize=10)
+
+        ubasic_workouts = WorkoutFactory.create_batch(5, user=rbasic)
+        rcoach.save()
+
+        ubasicpassword = faker.word()
+        ubasic.set_password(ubasicpassword)
+        ubasic.save()
+
+        self.ubasic = {
+            'user': ubasic,
+            'password': ubasicpassword,
+            'username': ubasic.username,
+            'workouts': ubasic_workouts,
+        }
+
+        ustrange = UserFactory(username='strangeuser')
+        rstrange = Rower.objects.create(user=ustrange,
+                                      birthdate=faker.profile()['birthdate'],
+                                      gdproptin=True,surveydone=True,gdproptindate=timezone.now(),
+                                           rowerplan='basic',clubsize=10)
+
+        ustrange_workouts = WorkoutFactory.create_batch(5, user=rstrange)
+        rcoach.save()
+
+        ustrangepassword = faker.word()
+        ustrange.set_password(ustrangepassword)
+        ustrange.save()
+
+        self.ustrange = {
+            'user': ustrange,
+            'password': ustrangepassword,
+            'username': ustrange.username,
+            'workouts': ustrange_workouts,
+        }
+
+
+        ## TeamPro, TeamCoach, TeamSelfCoach
+
+        self.teampro = Team.objects.create(
+            name=faker.word(),
+            notes=faker.text(),
+            manager=self.upro['user'])
+
+        self.teamplan = Team.objects.create(
+            name=faker.word()+'2',
+            notes=faker.text(),
+            manager=self.uplan2['user'])
+
+        self.teamcoach = Team.objects.create(
+            name=faker.word()+'3',
+            notes=faker.text(),
+            manager=self.ucoach['user'])
+
+        self.uplan['user'].rower.team.add(self.teamcoach)
+        self.ubasic['user'].rower.team.add(self.teamcoach)
+        self.ucoach['user'].rower.team.add(self.teamcoach)
+        self.upro['user'].rower.team.add(self.teamcoach)
+
+        self.upro['user'].rower.team.add(self.teamplan)
+        self.uplan2['user'].rower.team.add(self.teamplan)
+
+        self.upro['user'].rower.team.add(self.teampro)
+        self.uplan['user'].rower.team.add(self.teampro)
+
+        self.uplan['user'].rower.coachinggroups.add(coachinggroup)
+        self.ubasic['user'].rower.coachinggroups.add(coachinggroup)
+
+
+    # Test access for anonymous users
+    @parameterized.expand(viewstotest)
+    @patch('rowers.c2stuff.Session', side_effect=mocked_requests)
+    @patch('rowers.c2stuff.c2_open')
+    @patch('rowers.dataprep.create_engine')
+    @patch('rowers.dataprep.read_df_sql')
+    @patch('rowers.dataprep.getsmallrowdata_db')
+    @patch('requests.get',side_effect=mocked_requests)
+    @patch('requests.post',side_effect=mocked_requests)
+    @patch('rowers.dataprep.get_video_data',side_effect=mocked_get_video_data)
+    def test_permissions_anonymous(
+        self,view,permissions,
+        mock_Session,
+        mock_c2open,
+        mocked_sqlalchemy,
+        mocked_read_df_sql,
+        mocked_getsmallrowdata_db,
+        mock_get,
+        mock_post,
+        mocked_get_video_data,
+        ):
+
+        print()
+        print(view,'anonymous',permissions['anonymous'],permissions['is_staff'],permissions['dotest'])
+        print()
+
+        if permissions['anonymous'] and not permissions['is_staff'] and permissions['dotest']:
+            urlstotest = []
+            if permissions['workoutid']:
+                url = reverse(view,kwargs={'id':encoder.encode_hex(self.ucoach['workouts'][0].id)})
+                urlstotest.append(url)
+            else:
+                url = reverse(view)
+                urlstotest.append(url)
+
+            print(view,'anonymous',urlstotest)
+
+            for url in urlstotest:
+                result = self.c.get(url)
+                self.assertEqual(result.status_code,permissions['anonymous_response'])
+
+    # Test access for logged in  users - accessing own objects
+    @parameterized.expand(viewstotest)
+    @patch('rowers.c2stuff.Session', side_effect=mocked_requests)
+    @patch('rowers.c2stuff.c2_open')
+    @patch('rowers.dataprep.create_engine')
+    @patch('rowers.dataprep.read_df_sql')
+    @patch('rowers.dataprep.getsmallrowdata_db')
+    @patch('requests.get',side_effect=mocked_requests)
+    @patch('requests.post',side_effect=mocked_requests)
+    @patch('rowers.dataprep.get_video_data',side_effect=mocked_get_video_data)
+    def test_permissions_own(
+        self,view,permissions,
+        mock_Session,
+        mock_c2open,
+        mocked_sqlalchemy,
+        mocked_read_df_sql,
+        mocked_getsmallrowdata_db,
+        mock_get,
+        mock_post,
+        mocked_get_video_data,
+        ):
+
+        print()
+        print(view,'own')
+        print()
+
+        if permissions['own'] in plans and not permissions['is_staff'] and permissions['dotest']:
+            urlstotest = []
+            falseurlstotest = []
+            otheruserurls = []
+
+            thisuser = self.ubasic
+            memberuser = self.uplan
+            notuser = None
+
+            print(view,'own')
+
+            if permissions['own'] == 'basic':
+                thisuser = self.ubasic
+                memberuser = self.uplan
+                notuser = None
+            elif permissions['own'] == 'pro':
+                thisuser = self.upro
+                notuser = self.ubasic
+            elif permissions['own'] == 'plan':
+                thisuser = self.uplan
+                notuser = self.upro
+            elif permissions['own'] == 'coach':
+                thisuser = self.ucoach
+                notuser = self.uplan
+
+
+            if permissions['workoutid']:
+                workouts = thisuser['workouts']
+                url = reverse(view,kwargs={'id':encoder.encode_hex(workouts[0].id)})
+                urlstotest.append(url)
+                if notuser:
+                    workouts = notuser['workouts']
+                    url = reverse(view,kwargs={'id':encoder.encode_hex(workouts[0].id)})
+                    falseurlstotest.append(url)
+            elif permissions['userid']:
+                url = reverse(view,kwargs={'userid':thisuser['user'].id})
+                urlstotest.append(url)
+
+                url = reverse(view,kwargs={'userid':self.ustrange['user'].id})
+                otheruserurls.append(url)
+            else:
+                url = reverse(view)
+                urlstotest.append(url)
+
+            print(view,'own',urlstotest,falseurlstotest,otheruserurls)
+
+            # test logged in as user who has permissions
+            for url in urlstotest:
+                login = self.c.login(username = thisuser['username'],password = thisuser['password'])
+                result = self.c.get(url)
+                self.assertEqual(result.status_code, permissions['own_response'])
+
+            # test logged as user with no permissions (e.g. too low plan)
+            for url in falseurlstotest:
+                login = self.c.login(username = notuser['username'],password = notuser['password'])
+                result = self.c.get(url)
+                self.assertEqual(result.status_code, permissions['own_nonperm'])
+
+            # test as user with permissions, accessing object of non-related user
+            for url in otheruserurls:
+                login = self.c.login(username=thisuser['username'],password = thisuser['password'])
+                result = self.c.get(url)
+                self.assertEqual(result.status_code,403)
+
+    # Test access for logged in  users - accessing team member objects
+    @parameterized.expand(viewstotest)
+    @patch('rowers.c2stuff.Session', side_effect=mocked_requests)
+    @patch('rowers.c2stuff.c2_open')
+    @patch('rowers.dataprep.create_engine')
+    @patch('rowers.dataprep.read_df_sql')
+    @patch('rowers.dataprep.getsmallrowdata_db')
+    @patch('requests.get',side_effect=mocked_requests)
+    @patch('requests.post',side_effect=mocked_requests)
+    @patch('rowers.dataprep.get_video_data',side_effect=mocked_get_video_data)
+    def test_permissions_member(
+        self,view,permissions,
+        mock_Session,
+        mock_c2open,
+        mocked_sqlalchemy,
+        mocked_read_df_sql,
+        mocked_getsmallrowdata_db,
+        mock_get,
+        mock_post,
+        mocked_get_video_data,
+        ):
+
+        print()
+        print(view,'member')
+        print()
+
+        if permissions['member'] in plans and permissions['is_staff'] is False and permissions['dotest']:
+            urlstotest = []
+            falseurlstotest = []
+            otheruserurls = []
+
+            thisuser = self.ubasic
+            memberuser = self.uplan
+            notuser = None
+
+            print(view,'member')
+
+            if permissions['member'] == 'basic':
+                thisuser = self.ubasic
+                memberuser = self.uplan
+                notuser = None
+            elif permissions['member'] == 'pro':
+                thisuser = self.upro
+                memberuser = self.uplan
+                notuser = self.ubasic
+            elif permissions['member'] == 'plan':
+                thisuser = self.uplan
+                memberuser = self.ubasic
+                notuser = self.upro
+            elif permissions['member'] == 'coach':
+                thisuser = self.ucoach
+                memberuser = self.uplan
+                notuser = self.uplan
+
+
+            if permissions['workoutid']:
+                workouts = memberuser['workouts']
+                url = reverse(view,kwargs={'id':encoder.encode_hex(workouts[0].id)})
+                urlstotest.append(url)
+                if notuser:
+                    falseurlstotest.append(url)
+            elif permissions['userid']:
+                url = reverse(view,kwargs={'userid':memberuser['user'].id})
+                urlstotest.append(url)
+
+                url = reverse(view,kwargs={'userid':self.ustrange['user'].id})
+                otheruserurls.append(url)
+            else:
+                url = reverse(view)
+                urlstotest.append(url)
+
+            print('member',urlstotest,falseurlstotest,otheruserurls)
+
+            # test logged in as user who has permissions
+            for url in urlstotest:
+                login = self.c.login(username = thisuser['username'],password = thisuser['password'])
+                result = self.c.get(url)
+                self.assertEqual(result.status_code, permissions['member_response'])
+
+            # test logged as user with no permissions (e.g. too low plan)
+            for url in falseurlstotest:
+                login = self.c.login(username = notuser['username'],password = notuser['password'])
+                result = self.c.get(url)
+                self.assertEqual(result.status_code, permissions['member_nonperm'])
+
+            # test as user with permissions, accessing object of non-related user
+            for url in otheruserurls:
+                login = self.c.login(username=thisuser['username'],password = thisuser['password'])
+                result = self.c.get(url)
+                self.assertEqual(result.status_code,403)
+
+    # Test access for logged in  users - accessing coachee
+    @parameterized.expand(viewstotest)
+    @patch('rowers.c2stuff.Session', side_effect=mocked_requests)
+    @patch('rowers.c2stuff.c2_open')
+    @patch('rowers.dataprep.create_engine')
+    @patch('rowers.dataprep.read_df_sql')
+    @patch('rowers.dataprep.getsmallrowdata_db')
+    @patch('requests.get',side_effect=mocked_requests)
+    @patch('requests.post',side_effect=mocked_requests)
+    @patch('rowers.dataprep.get_video_data',side_effect=mocked_get_video_data)
+    def test_permissions_coachee(
+        self,view,permissions,
+        mock_Session,
+        mock_c2open,
+        mocked_sqlalchemy,
+        mocked_read_df_sql,
+        mocked_getsmallrowdata_db,
+        mock_get,
+        mock_post,
+        mocked_get_video_data,
+        ):
+
+        print()
+        print(view,'coachee')
+        print()
+
+        if permissions['coachee'] in plans and not permissions['is_staff'] and permissions['dotest']:
+            urlstotest = []
+            falseurlstotest = []
+            otheruserurls = []
+
+            thisuser = self.ucoach
+            coacheeuser = self.ubasic
+            notuser = self.uplan
+
+
+
+            if permissions['workoutid']:
+                workouts = coacheeuser['workouts']
+                url = reverse(view,kwargs={'id':encoder.encode_hex(workouts[0].id)})
+                urlstotest.append(url)
+
+            elif permissions['userid']:
+                url = reverse(view,kwargs={'userid':coacheeuser['user'].id})
+                urlstotest.append(url)
+
+                url = reverse(view,kwargs={'userid':self.ustrange['user'].id})
+                otheruserurls.append(url)
+            else:
+                url = reverse(view)
+                urlstotest.append(url)
+
+            print('coachee',urlstotest,falseurlstotest,otheruserurls)
+
+            # test logged in as user who has permissions
+            for url in urlstotest:
+                login = self.c.login(username = thisuser['username'],password = thisuser['password'])
+                result = self.c.get(url)
+                self.assertEqual(result.status_code, permissions['coachee_response'])
+
+            # test as user with permissions, accessing object of non-related user
+            for url in otheruserurls:
+                login = self.c.login(username=thisuser['username'],password = thisuser['password'])
+                result = self.c.get(url)
+                self.assertEqual(result.status_code,403)

rowers/tests/test_plans.py

@@ -6,6 +6,7 @@ from __future__ import unicode_literals
 #from __future__ import print_function
 from .statements import *
 nu = datetime.datetime.now()
+
 from rowers.utils import allmonths,allsundays
 
 import rowers.plannedsessions as plannedsessions
@@ -125,7 +126,6 @@ class TrainingPlanTest(TestCase):
 
         for url in urls:
             if 'planbyweeks' in url and not tested:
-                print(url)
                 response = self.c.get(url,follow=True)
                 self.assertEqual(response.status_code,200)
                 tested = True

rowers/tests/test_rowerplans.py

@@ -6,7 +6,8 @@ from __future__ import unicode_literals
 from .statements import *
 nu = datetime.datetime.now()
 
-from rowers.views import hasplannedsessions,iscoachmember,ispromember
+from rowers.views import isplanmember,iscoachmember,ispromember
+from rowers.rower_rules import *
 
 class TrialsTest(TestCase):
     def setUp(self):
@@ -33,34 +34,35 @@ class TrialsTest(TestCase):
                 pass
 
     def test_basictrial(self):
-        self.assertEqual(hasplannedsessions(self.u),False)
+        self.assertEqual(isplanmember(self.u),False)
         self.assertEqual(iscoachmember(self.u),False)
         self.assertEqual(ispromember(self.u),False)
 
         self.r.protrialexpires = (nu+datetime.timedelta(days=10)).date()
         self.r.save()
 
-        self.assertEqual(hasplannedsessions(self.u),False)
+        self.assertEqual(isplanmember(self.u),False)
         self.assertEqual(iscoachmember(self.u),False)
         self.assertEqual(ispromember(self.u),True)
 
         self.r.plantrialexpires = (nu+datetime.timedelta(days=10)).date()
         self.r.save()
 
-        self.assertEqual(hasplannedsessions(self.u),True)
+        self.assertEqual(isplanmember(self.u),True)
         self.assertEqual(iscoachmember(self.u),False)
         self.assertEqual(ispromember(self.u),True)
 
     def test_protrial(self):
         self.r.rowerplan = 'pro'
         self.r.save()
-        self.assertEqual(hasplannedsessions(self.u),False)
+        self.assertEqual(isplanmember(self.u),False)
         self.assertEqual(iscoachmember(self.u),False)
         self.assertEqual(ispromember(self.u),True)
 
         self.r.plantrialexpires = (nu+datetime.timedelta(days=10)).date()
         self.r.save()
 
-        self.assertEqual(hasplannedsessions(self.u),True)
+        self.assertEqual(is_plantrial(self.u),True)
+        self.assertEqual(isplanmember(self.u),True)
         self.assertEqual(iscoachmember(self.u),False)
         self.assertEqual(ispromember(self.u),True)

rowers/tests/test_urls.py

@@ -209,7 +209,6 @@ class URLTests(TestCase):
         '/rowers/workout/'+encoded1+'/editintervals/',
         '/rowers/workout/'+encoded1+'/flexchart/',
         '/rowers/workout/'+encoded1+'/forcecurve/',
-        '/rowers/workout/'+encoded1+'/get-testscript/',
         '/rowers/workout/'+encoded1+'/get-thumbnails/',
         '/rowers/workout/'+encoded1+'/histo/',
         '/rowers/workout/'+encoded1+'/image/',

rowers/tests/viewnames.csv

@@ -0,0 +1,310 @@
+,id,view,function,anonymous,anonymous_response,own,own_response,own_nonperm,member,member_response,member_nonperm,coachee,coachee_response,coachee_nonperm,is_staff,userid,workoutid,dotest,realtest,kwargs
+0,0,workouts_summaries_email_view,sends summary excel with workouts list and links to data to user,TRUE,302,basic,200,302,FALSE,403,403,FALSE,403,403,FALSE,FALSE,FALSE,TRUE,TRUE,
+1,1,rower_update_empower_view,updates old Empower Oarlock files (corrects Power bug),TRUE,302,basic,200,302,FALSE,200,302,FALSE,200,302,FALSE,FALSE,FALSE,TRUE,TRUE,
+2,2,agegroupcpview,needs age,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+3,4,ajax_agegrouprecords,gets age group records from C2 ,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+4,5,fitness_metric_view,updates a person's fitness metric,TRUE,302,basic,302,302,FALSE,403,302,FALSE,403,403,FALSE,FALSE,FALSE,TRUE,TRUE,
+5,6,agegrouprecordview,shows ergo age group records,TRUE,200,basic,200,302,FALSE,200,302,FALSE,200,302,FALSE,FALSE,FALSE,TRUE,TRUE,
+6,7,workouts_view,workouts list,TRUE,302,basic,200,302,basic,200,403,coach,200,403,FALSE,TRUE,FALSE,TRUE,TRUE,
+7,8,virtualevents_view,virtual races list,TRUE,200,basic,200,302,FALSE,200,302,FALSE,200,302,FALSE,FALSE,FALSE,TRUE,TRUE,
+8,9,virtualevent_create_view,create virtual event,TRUE,302,basic,200,302,FALSE,200,302,FALSE,200,302,FALSE,FALSE,FALSE,TRUE,TRUE,
+9,10,indoorvirtualevent_create_view,create indoor virtual event,TRUE,302,basic,200,302,FALSE,200,302,FALSE,200,302,FALSE,FALSE,FALSE,TRUE,TRUE,
+10,11,virtualevent_toggle_email_view,toggle email notifications,TRUE,302,basic,200,302,FALSE,200,302,FALSE,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+11,12,indoorvirtualevent_toggle_email_view,toggle email notifications,TRUE,302,basic,200,302,FALSE,200,302,FALSE,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+12,13,virtualevent_view,view virtual race,TRUE,200,basic,200,302,FALSE,200,302,FALSE,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+13,14,virtualevent_ranking_view,view ranking,TRUE,200,basic,200,302,FALSE,200,302,FALSE,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+14,15,virtualevent_edit_view,edit race,TRUE,302,basic,200,302,FALSE,200,302,FALSE,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+15,16,indoorvirtualevent_edit_view,edit race,TRUE,302,basic,200,302,FALSE,200,302,FALSE,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+16,17,virtualevent_register_view,register for race,TRUE,302,basic,200,302,FALSE,200,302,FALSE,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+17,18,indoorvirtualevent_register_view,register for race,TRUE,302,basic,200,302,FALSE,200,302,FALSE,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+18,19,virtualevent_addboat_view,add a new boat type,TRUE,302,basic,200,302,FALSE,200,302,FALSE,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+19,20,virtualevent_withdraw_view,withdraw,TRUE,302,basic,200,302,FALSE,200,302,FALSE,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+20,21,virtualevent_submit_result_view,submit a result,TRUE,302,basic,200,302,FALSE,200,302,FALSE,200,302,FALSE,FALSE,TRUE,FALSE,FALSE,
+21,22,virtualevent_disqualify_view,disqualify a racer,TRUE,302,basic,200,302,FALSE,200,302,FALSE,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+22,24,courses_view,see race courses,TRUE,200,FALSE,200,302,FALSE,200,302,FALSE,200,302,FALSE,FALSE,FALSE,TRUE,TRUE,
+23,25,course_upload_view,upload a new course,TRUE,302,basic,200,302,FALSE,200,302,FALSE,200,302,FALSE,FALSE,FALSE,TRUE,TRUE,
+24,26,addmanual_view,upload a manual workout,TRUE,302,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,TRUE,TRUE,
+25,27,team_comparison_select,compare with a team member workout,TRUE,302,pro,200,302,pro,200,302,coach,200,302,FALSE,TRUE,TRUE,TRUE,TRUE,
+26,28,workouts_join_view,join workouts,TRUE,302,pro,302,302,pro,403,403,coach,302,403,FALSE,TRUE,FALSE,TRUE,TRUE,
+27,29,workouts_join_select,select workouts to join,TRUE,404,pro,200,302,pro,403,403,coach,200,403,FALSE,TRUE,FALSE,TRUE,TRUE,
+28,30,user_boxplot_select,select boxplots,TRUE,302,pro,200,302,pro,403,403,coach,200,302,FALSE,TRUE,FALSE,TRUE,TRUE,
+29,31,analysis_new,analysis front page,TRUE,302,pro,200,302,FALSE,200,302,coach,200,302,FALSE,TRUE,FALSE,TRUE,TRUE,
+30,32,user_multiflex_select,select multiflex data,TRUE,302,pro,200,302,FALSE,200,302,coach,200,302,FALSE,TRUE,FALSE,TRUE,TRUE,
+31,33,session_jobs_view,view jobs,TRUE,302,basic,200,302,FALSE,200,302,coach,200,302,FALSE,FALSE,FALSE,TRUE,TRUE,
+32,34,session_jobs_status,view jobs,TRUE,302,basic,200,302,FALSE,200,302,coach,200,302,FALSE,FALSE,FALSE,TRUE,TRUE,
+33,35,kill_async_job,kill job,TRUE,302,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+34,36,post_progress,post progress,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+35,37,graphs_view,view charts,TRUE,302,basic,200,302,basic,200,302,coach,200,302,FALSE,TRUE,FALSE,TRUE,TRUE,
+36,38,fitnessmetric_view,view fitness metric,TRUE,302,plan,200,302,plan,403,302,coach,200,302,FALSE,TRUE,FALSE,TRUE,TRUE,
+37,39,rankings_view,view ranking,TRUE,302,pro,200,302,pro,403,302,coach,200,302,FALSE,TRUE,FALSE,TRUE,TRUE,
+38,40,rankings_view2,view ranking,TRUE,302,pro,200,302,pro,403,302,coach,200,302,FALSE,TRUE,FALSE,TRUE,TRUE,
+39,41,otwrankings_view,view ranking,TRUE,302,pro,200,302,pro,403,302,coach,200,302,FALSE,TRUE,FALSE,TRUE,TRUE,
+40,42,oterankings_view,view ranking,TRUE,302,pro,200,302,pro,403,302,coach,200,302,FALSE,TRUE,FALSE,TRUE,TRUE,
+41,43,cum_flex,flex all chart,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+42,44,analysis_view_data,redirects to analysis direct,TRUE,302,pro,302,302,pro,302,302,coach,302,302,FALSE,FALSE,FALSE,TRUE,TRUE,
+43,47,cum_flex_data,flex all chart data (json),TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+44,48,histo,histogram view,TRUE,302,pro,200,302,pro,403,302,coach,200,302,FALSE,TRUE,FALSE,TRUE,TRUE,
+45,49,histo_data,histogram data,TRUE,302,pro,200,302,pro,200,302,coach,200,302,FALSE,FALSE,FALSE,TRUE,TRUE,
+46,51,cumstats,cumulative statistics,TRUE,302,pro,200,302,pro,403,302,coach,200,302,FALSE,TRUE,FALSE,TRUE,TRUE,
+47,53,graph_show_view,show a chart,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+48,54,GraphDelete,delete a chart,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+49,55,get_thumbnails,get thumbnails,TRUE,403,basic,200,302,basic,403,403,coach,200,302,FALSE,FALSE,TRUE,TRUE,TRUE,
+50,56,otw_use_impeller,switch to impeller data,TRUE,403,basic,302,302,basic,403,302,coach,302,302,FALSE,FALSE,TRUE,TRUE,TRUE,
+51,57,otw_use_gps,switch to GPS data,TRUE,403,basic,302,302,basic,403,302,coach,302,302,FALSE,FALSE,TRUE,TRUE,TRUE,
+52,58,workout_toggle_ranking,toggle ranking,TRUE,302,basic,302,302,basic,403,302,coach,302,302,FALSE,FALSE,TRUE,TRUE,TRUE,
+53,59,team_workout_upload_view,upload workout for team member,TRUE,302,coach,200,302,FALSE,200,302,FALSE,200,302,FALSE,FALSE,FALSE,TRUE,TRUE,
+54,60,workout_upload_view,upload a workout,TRUE,302,basic,200,302,FALSE,200,302,FALSE,200,302,FALSE,FALSE,FALSE,TRUE,TRUE,
+55,61,workout_histo_view,histogram  ,TRUE,302,basic,200,302,basic,403,403,coach,200,302,FALSE,FALSE,TRUE,TRUE,TRUE,
+56,62,workout_forcecurve_view,force curve,TRUE,302,pro,200,302,pro,403,302,coach,200,302,FALSE,FALSE,TRUE,TRUE,TRUE,
+57,63,workout_unsubscribe_view,unsubscribe from comments,TRUE,302,basic,200,302,basic,200,302,basic,200,302,FALSE,FALSE,TRUE,TRUE,TRUE,
+58,64,workout_comment_view,comment on workout,TRUE,302,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,TRUE,TRUE,TRUE,
+59,65,workout_tcxemail_view,download TCX file,TRUE,403,basic,200,302,basic,403,403,coach,200,403,FALSE,FALSE,TRUE,TRUE,TRUE,
+60,66,workout_gpxemail_view,download GPX file,TRUE,403,basic,200,302,basic,403,403,coach,200,403,FALSE,FALSE,TRUE,TRUE,TRUE,
+61,67,workout_csvemail_view,download CSV file,TRUE,403,basic,200,302,basic,403,403,coach,200,403,FALSE,FALSE,TRUE,TRUE,TRUE,
+62,68,workout_csvtoadmin_view,send CSV to admin,TRUE,403,basic,200,200,basic,200,200,coach,200,200,TRUE,FALSE,TRUE,TRUE,TRUE,
+63,69,workout_edit_view,Edit Workout,TRUE,403,basic,200,403,basic,403,403,coach,200,403,FALSE,FALSE,TRUE,TRUE,TRUE,
+64,70,workout_map_view,View workout Map,TRUE,302,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,TRUE,TRUE,TRUE,
+65,71,workout_update_cp_view,Update CP data based on new workout,TRUE,403,pro,302,302,pro,403,403,coach,302,302,FALSE,FALSE,TRUE,TRUE,TRUE,
+66,72,instroke_chart,View In-Stroke data chart,TRUE,302,pro,302,302,pro,403,403,coach,302,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+67,73,instroke_view,Create in stroke chart,TRUE,403,basic,200,302,basic,403,403,coach,200,302,FALSE,FALSE,TRUE,TRUE,TRUE,
+68,74,workout_stats_view,View Workout Stats,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,TRUE,TRUE,TRUE,
+69,75,workout_data_view,shows the detailed data for a workout,TRUE,403,basic,200,403,basic,403,403,coach,200,403,FALSE,FALSE,TRUE,TRUE,TRUE,
+70,76,workout_otwsetpower_view,set weight and start offline OTW power calculations,TRUE,403,pro,200,302,pro,403,403,coach,200,403,FALSE,FALSE,TRUE,TRUE,TRUE,
+71,77,workout_otwpowerplot_view,generates OTW power chart,TRUE,200,basic,200,200,basic,200,200,coach,200,302,FALSE,FALSE,TRUE,TRUE,TRUE,
+72,78,workout_wind_view,set wind,TRUE,403,pro,200,302,pro,403,403,coach,200,403,FALSE,FALSE,TRUE,TRUE,TRUE,
+73,79,workout_uploadimage_view,upload image,TRUE,403,basic,200,403,basic,403,403,coach,200,403,FALSE,FALSE,TRUE,TRUE,TRUE,
+74,80,virtualevent_compare_view,compare workouts from a virtual event,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+75,81,virtualevent_uploadimage_view,upload image to virtual event,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+76,82,virtualevent_setlogo_view,set logo of virtual event,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+77,83,logo_delete_view,delete logo,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+78,84,workout_downloadwind_view,download Wind,TRUE,403,pro,302,302,pro,403,403,coach,302,403,FALSE,FALSE,TRUE,FALSE,FALSE,
+79,85,workout_downloadmetar_view,download METAR,TRUE,403,pro,200,302,pro,403,403,coach,200,403,FALSE,FALSE,TRUE,FALSE,FALSE,
+80,86,workout_stream_view,edit stream (redirects as no data in test suite),TRUE,403,pro,200,302,pro,403,403,coach,200,302,FALSE,FALSE,TRUE,TRUE,TRUE,
+81,87,workout_summary_edit_view,edit workout summary,TRUE,403,basic,200,403,basic,403,403,coach,200,403,FALSE,FALSE,TRUE,TRUE,TRUE,
+82,88,workout_summary_restore_view,restore workout summary,TRUE,403,basic,302,403,basic,403,403,coach,302,403,FALSE,FALSE,TRUE,TRUE,TRUE,
+83,89,workout_split_view,split workout,TRUE,403,pro,200,302,pro,403,403,coach,200,302,FALSE,FALSE,TRUE,TRUE,TRUE,
+84,90,workout_view,view workout  ,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,TRUE,TRUE,TRUE,
+85,91,workout_video_create_view,add video ,TRUE,403,pro,200,302,pro,403,403,coach,200,302,FALSE,FALSE,TRUE,TRUE,TRUE,
+86,92,VideoDelete,delete video,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+87,93,workout_video_view_mini,minimal view,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,TRUE,FALSE,FALSE,
+88,94,workout_video_view,"video view (not tested, no video in test suite)",TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,TRUE,FALSE,FALSE,
+89,95,list_videos,list my videos,TRUE,302,pro,200,302,pro,200,302,coach,200,302,FALSE,FALSE,FALSE,TRUE,TRUE,
+90,96,video_selectworkout,select workout to create video,TRUE,302,pro,200,302,pro,403,403,coach,200,302,FALSE,TRUE,FALSE,TRUE,TRUE,
+91,98,workout_fusion_view,needs to workouts,TRUE,403,pro,200,302,pro,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+92,99,workout_fusion_list,list workouts to fuse with,TRUE,302,pro,200,302,pro,403,302,coach,200,302,FALSE,FALSE,TRUE,TRUE,TRUE,
+94,103,workout_add_chart_view,add chart,TRUE,403,basic,302,403,basic,403,403,coach,302,403,FALSE,FALSE,TRUE,FALSE,FALSE,
+95,112,WorkoutDelete,delete workout,TRUE,403,basic,200,302,basic,403,403,coach,403,403,FALSE,FALSE,TRUE,FALSE,FALSE,
+96,113,workout_smoothenpace_view,smoothen pace,TRUE,403,pro,302,302,pro,403,403,coach,302,403,FALSE,FALSE,TRUE,TRUE,TRUE,
+97,114,workout_undo_smoothenpace_view,unsmoothen pace,TRUE,403,pro,302,302,pro,403,403,coach,302,403,FALSE,FALSE,TRUE,TRUE,TRUE,
+98,115,workout_c2import_view,list workouts to be imported (test stops at notokenerror),TRUE,302,basic,302,302,basic,403,403,coach,302,403,FALSE,TRUE,FALSE,TRUE,TRUE,
+99,120,workout_stravaimport_view,list workouts to be imported (test stops at notokenerror),TRUE,302,basic,302,302,basic,403,403,coach,302,403,FALSE,TRUE,FALSE,TRUE,TRUE,
+100,122,workout_getc2workout_all,gets all C2 workouts (now redirects due to NoTokenError,TRUE,302,basic,302,302,FALSE,302,302,FALSE,302,302,FALSE,FALSE,FALSE,TRUE,TRUE,
+101,124,workout_getimportview,imports a workout from third party,TRUE,200,basic,200,302,FALSE,200,302,FALSE,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+102,125,workout_getstravaworkout_all,gets all C2 workouts (now redirects due to NoTokenError,TRUE,302,basic,302,302,FALSE,302,302,FALSE,302,302,FALSE,FALSE,FALSE,TRUE,TRUE,
+103,126,workout_getstravaworkout_next,gets all strava workouts,TRUE,302,basic,302,302,FALSE,200,302,FALSE,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+104,127,workout_sporttracksimport_view,list workouts to be imported (test stops at notokenerror),TRUE,302,basic,302,302,basic,403,403,coach,302,403,FALSE,TRUE,FALSE,TRUE,TRUE,
+105,129,workout_getsporttracksworkout_all,gets all C2 workouts (now redirects due to NoTokenError,TRUE,302,basic,302,302,FALSE,302,302,FALSE,302,302,FALSE,FALSE,FALSE,TRUE,TRUE,
+106,130,workout_polarimport_view,list workouts to be imported (test stops at notokenerror),TRUE,302,basic,302,302,basic,403,403,coach,302,403,FALSE,TRUE,FALSE,TRUE,TRUE,
+107,132,workout_runkeeperimport_view,list workouts to be imported (test stops at notokenerror),TRUE,302,basic,302,302,basic,403,403,coach,302,403,FALSE,TRUE,FALSE,TRUE,TRUE,
+108,134,workout_underarmourimport_view,list workouts to be imported (test stops at notokenerror),TRUE,302,basic,302,302,basic,403,403,coach,302,403,FALSE,TRUE,FALSE,TRUE,TRUE,
+109,135,workout_c2_upload_view,uploads workout to C2,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,TRUE,FALSE,FALSE,
+110,136,workout_strava_upload_view,uploads workout to C2,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,TRUE,FALSE,FALSE,
+111,137,workout_recalcsummary_view,recalculates workout summary,TRUE,403,basic,302,403,basic,403,403,coach,302,403,FALSE,FALSE,TRUE,TRUE,TRUE,
+112,138,workout_sporttracks_upload_view,uploads workout to C2,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,TRUE,FALSE,FALSE,
+113,139,workout_runkeeper_upload_view,uploads workout to C2,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,TRUE,FALSE,FALSE,
+114,140,workout_underarmour_upload_view,uploads workout to C2,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,TRUE,FALSE,FALSE,
+115,141,workout_tp_upload_view,uploads workout to C2,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,TRUE,FALSE,FALSE,
+116,142,multi_compare_view,compare workouts  ,TRUE,302,basic,302,403,basic,302,403,coach,302,302,FALSE,FALSE,TRUE,TRUE,TRUE,
+117,145,alerts_view,view alerts,TRUE,302,basic,200,403,basic,403,403,coach,200,302,FALSE,TRUE,FALSE,TRUE,TRUE,
+118,147,AlertDelete,delete alert,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+119,148,alert_edit_view,edit alert,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+120,150,alert_create_view,create alert,TRUE,302,pro,200,403,pro,403,403,coach,200,403,FALSE,TRUE,FALSE,TRUE,TRUE,
+121,152,alert_report_view,view alerts report,TRUE,302,basic,200,403,basic,403,403,coach,200,403,FALSE,FALSE,FALSE,FALSE,FALSE,
+122,155,boxplot_view,View boxplot,TRUE,302,pro,302,403,pro,403,403,coach,302,403,FALSE,TRUE,FALSE,TRUE,TRUE,
+123,157,boxplot_view_data,data for boxplot,TRUE,302,pro,200,403,pro,200,403,coach,200,403,FALSE,FALSE,FALSE,FALSE,FALSE,
+124,158,multiflex_view,view multiflex,TRUE,302,pro,302,403,pro,403,403,coach,302,403,FALSE,TRUE,FALSE,TRUE,TRUE,
+125,160,multiflex_data,data for multiflex,TRUE,302,pro,200,403,pro,200,403,coach,200,403,FALSE,FALSE,FALSE,FALSE,FALSE,
+126,161,deactivate_user,deactivate a user,TRUE,302,basic,200,302,FALSE,403,403,FALSE,403,403,FALSE,FALSE,FALSE,TRUE,TRUE,
+127,162,remove_user,remove a user,TRUE,302,basic,200,302,FALSE,403,403,FALSE,403,403,FALSE,FALSE,FALSE,TRUE,TRUE,
+128,163,user_gdpr_confirm,GDPR confirmation,TRUE,302,basic,302,302,FALSE,403,403,FALSE,403,403,FALSE,FALSE,FALSE,TRUE,TRUE,
+129,165,user_gdpr_optin,GDPR optin,TRUE,302,basic,200,302,FALSE,200,302,FALSE,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+130,167,rower_teams_view,view team,TRUE,302,basic,200,302,FALSE,200,302,FALSE,200,302,FALSE,FALSE,FALSE,TRUE,TRUE,
+131,168,rower_calcdps_view,calculates distance per stroke,TRUE,302,basic,302,302,FALSE,200,302,FALSE,200,302,FALSE,FALSE,FALSE,TRUE,TRUE,
+132,169,rower_exportsettings_view,Export settings,TRUE,302,basic,200,302,basic,403,403,coach,200,403,FALSE,TRUE,FALSE,TRUE,TRUE,
+133,171,team_view,Team view,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+134,172,team_members_stats_view,Stats for team members,TRUE,302,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+135,173,team_edit_view,View Team,TRUE,302,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+136,174,team_leaveconfirm_view,Leave Team,TRUE,302,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+137,175,team_leave_view,Leave Team,TRUE,302,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+138,176,team_deleteconfirm_view,Delete Team,TRUE,302,pro,200,302,pro,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+139,177,team_requestmembership_view,Request team membership,TRUE,302,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+140,178,reject_revoke_coach_request,Reject request,TRUE,302,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+141,179,coach_drop_athlete_confirm_view,Drop athlete,TRUE,302,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+142,180,coach_drop_athlete_view,Drop athlete,TRUE,302,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+143,181,athlete_drop_coach_confirm_view,Drop athlete,TRUE,302,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+144,182,athlete_drop_coach_view,Drop coach,TRUE,302,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+145,184,reject_revoke_coach_offer,Reject offer,TRUE,302,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+146,186,request_coaching_view,Request coaching,TRUE,302,basic,302,302,FALSE,200,302,FALSE,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+147,187,offer_coaching_view,Offer Coaching,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,TRUE,FALSE,FALSE,FALSE,
+148,188,coach_accept_coachrequest_view,Accept Coach request,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+149,189,rower_accept_coachoffer_view,Accept Coach offer,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+150,190,team_delete_view,Delete Team,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+151,191,team_create_view,Create Team,TRUE,302,pro,302,302,FALSE,200,200,FALSE,200,302,FALSE,FALSE,FALSE,TRUE,TRUE,
+152,192,manager_member_drop_view,Drop member,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+153,193,invitation_reject_view,Reject invitation,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+154,194,invitation_revoke_view,redirects when no invitations,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+155,195,rower_invitations_view,See Invitations,TRUE,302,basic,302,302,FALSE,200,302,FALSE,200,302,FALSE,FALSE,FALSE,TRUE,TRUE,
+156,196,raise_500,Test 500 error,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+157,198,request_revoke_view,redirects when no invitations,TRUE,302,basic,302,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+158,199,request_reject_view,rejects request,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+159,200,manager_requests_view,views requests,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+160,202,rower_edit_view,edit rower preferences,TRUE,302,basic,200,403,basic,403,403,coach,200,403,FALSE,TRUE,FALSE,TRUE,TRUE,
+161,204,rower_prefs_view,edit more preferences,TRUE,302,basic,200,403,basic,403,403,coach,200,403,FALSE,TRUE,FALSE,TRUE,TRUE,
+162,205,transactions_view,view transactions (staff only),TRUE,302,basic,200,302,basic,200,302,coach,200,302,TRUE,FALSE,FALSE,TRUE,TRUE,
+163,208,rower_c2_authorize,redirects to C2 auth page,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+164,209,rower_polar_authorize,redirects to Polar,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+165,210,rower_revokeapp_view,revoke app,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+166,211,rower_strava_authorize,authorize on strava,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+167,212,rower_sporttracks_authorize,authorize on sporttracks,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+168,213,rower_underarmour_authorize,authorize on UA,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+169,214,rower_tp_authorize,authorize on TP,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+170,215,rower_runkeeper_authorize,authorize on RK,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+171,216,rower_sporttracks_token_refresh,refresh token,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+172,217,rower_underarmour_token_refresh,refresh token,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+173,218,rower_tp_token_refresh,refresh token,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+174,219,rower_c2_token_refresh,refresh token,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+175,220,rower_favoritecharts_view,See favorite charts,TRUE,302,pro,200,302,pro,403,403,coach,200,403,FALSE,TRUE,FALSE,TRUE,TRUE,
+176,222,workout_workflow_config2_view,configure workflow,TRUE,302,basic,200,302,basic,403,403,coach,200,403,FALSE,TRUE,FALSE,FALSE,FALSE,
+177,224,workflow_default_view,resets workflow to default,TRUE,302,basic,302,302,FALSE,403,403,FALSE,302,403,FALSE,FALSE,FALSE,TRUE,TRUE,
+178,225,sendmail,feedback form,TRUE,302,basic,302,302,FALSE,200,302,FALSE,200,302,FALSE,FALSE,FALSE,TRUE,TRUE,
+180,232,laboratory_view,lab,TRUE,302,basic,200,302,basic,403,403,coach,200,403,FALSE,TRUE,FALSE,TRUE,TRUE,
+181,233,errormessage_view,not used,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+182,237,payment_confirm_view,confirm payment,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+183,238,upgrade_confirm_view,confirm upgrade,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+184,240,downgrade_confirm_view,confirm downgrade,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+185,241,billing_view,confirm billing,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+186,242,upgrade_view,confirm upgrade,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+187,243,downgrade_view,confirm downgrade,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+188,244,payment_completed_view,payment completed,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+189,245,downgrade_completed_view,downgrade completed,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+190,246,paidplans_view,paid plans,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,TRUE,TRUE,
+191,247,plan_stop_view,stop plan,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+192,248,plan_tobasic_view,reset to basic,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+193,249,checkouts_view,checkout,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+194,250,upgrade_checkouts_view,upgrade checkout,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+195,251,downgrade_checkouts_view,downgrade checkout,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+196,252,planrequired_view,a plan is required,TRUE,302,basic,302,302,basic,302,302,coach,302,302,FALSE,FALSE,FALSE,TRUE,TRUE,
+197,253,start_trial_view,payments,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+198,254,start_plantrial_view,paid plans,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+199,256,rower_register_view,register rower,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,TRUE,TRUE,
+200,257,freecoach_register_view,register coach,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,TRUE,TRUE,
+201,259,workout_workflow_view,workout workflow vieq,TRUE,302,basic,200,200,basic,200,200,coach,200,200,FALSE,FALSE,TRUE,TRUE,TRUE,
+202,260,workout_flexchart3_view,flex chart,TRUE,302,basic,200,403,basic,200,200,coach,200,200,FALSE,FALSE,TRUE,TRUE,TRUE,
+203,264,rower_process_testcallback,test callback,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+204,265,rower_create_trainingplan,create training plan,TRUE,302,plan,200,302,FALSE,403,403,FALSE,200,403,FALSE,FALSE,FALSE,TRUE,TRUE,
+205,267,TrainingPlanDelete,delete training plan,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+206,268,MicroCycleDelete,delete training plan,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+207,269,MesoCycleDelete,delete training plan,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+208,270,MacroCycleDelete,delete training plan,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+209,271,rower_trainingplan_view,see training plan,TRUE,200,plan,200,302,plan,403,403,coach,200,403,FALSE,TRUE,FALSE,FALSE,FALSE,
+210,279,rower_trainingplan_execution_view,see training plan execution,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+211,281,TrainingMacroCycleUpdate,update macro cycle,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+212,282,TrainingMesoCycleUpdate,update cycle,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+213,283,planmacrocyclebymonth,update cycle,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+214,285,planmesocyclebyweek,plan meso by week,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+215,287,TrainingMicroCycleUpdate,update cycle,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+216,288,rower_delete_trainingtarget,delete training target,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+217,289,TrainingPlanUpdate,update trainingplan,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+218,290,TrainingTargetUpdate,update training target,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+219,291,strokedataform,test strokedata,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+220,292,plannedsession_teamcreate_view,create planned session for team,TRUE,302,coach,200,302,FALSE,200,302,FALSE,200,302,FALSE,FALSE,FALSE,TRUE,TRUE,
+221,296,plannedsession_teamedit_view,edit planned sesssion,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+222,298,plannedsession_create_view,create planned session   ,TRUE,302,plan,200,302,FALSE,200,302,coach,200,403,FALSE,TRUE,FALSE,TRUE,TRUE,
+223,300,plannedsession_multiclone_view,clone multiple planned sessions,TRUE,302,plan,200,302,plan,403,403,coach,200,403,FALSE,TRUE,FALSE,TRUE,TRUE,
+224,302,plannedsession_multicreate_view,create multiple planned sessions,TRUE,302,plan,200,302,plan,403,403,coach,200,403,FALSE,TRUE,FALSE,TRUE,TRUE,
+225,305,plannedsession_edit_view,edit planned sesssion,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+226,306,plannedsession_totemplate_view,planned session to template,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+227,307,plannedsession_compare_view,compare workouts from planned session,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+228,310,plannedsession_clone_view,clone planned session,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+229,311,plannedsession_teamclone_view,clone team planned session,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+230,313,plannedsession_detach_view,remove workout from session,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+231,315,plannedsession_view,view session,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+232,317,PlannedSessionDelete,delete session,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+233,319,plannedsessions_manage_view,manage planned sesions,TRUE,302,plan,200,302,plan,403,403,coach,200,403,FALSE,TRUE,FALSE,TRUE,TRUE,
+234,323,plannedsessions_coach_view,team view,TRUE,302,basic,200,403,basic,403,403,coach,200,403,FALSE,TRUE,FALSE,TRUE,TRUE,
+235,325,plannedsessions_coach_icsemail_view,team view,TRUE,302,coach,302,403,coach,302,403,coach,302,403,FALSE,TRUE,FALSE,TRUE,TRUE,
+236,326,plannedsessions_print_view,print view,TRUE,302,basic,200,403,basic,403,403,coach,200,403,FALSE,TRUE,FALSE,TRUE,TRUE,
+237,327,plannedsession_comment_view,comment on planned session,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+238,330,plannedsessions_icsemail_view,send ICS email,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,TRUE,FALSE,FALSE,FALSE,
+239,332,plannedsessions_view,View planned sessions,TRUE,302,basic,200,403,basic,403,403,coach,200,403,FALSE,TRUE,FALSE,TRUE,TRUE,
+240,334,course_edit_view,Edit course,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+241,335,course_delete_view,Delete course,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+242,336,course_kmldownload_view,Kmldownload course,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+243,337,course_replace_view,Replace course,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+244,338,course_view, view,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+245,339,course_map_view,Map course,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+246,341,c2listdebug_view,Debug view,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+247,343,rower_process_callback,Tested in specific test suite,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+248,344,rower_process_stravacallback,Tested in specific test suite,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+249,345,rower_process_sporttrackscallback,Tested in specific test suite,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+250,346,rower_process_underarmourcallback,Tested in specific test suite,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+251,347,rower_process_polarcallback,Tested in specific test suite,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+252,348,rower_process_runkeepercallback,Tested in specific test suite,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+253,349,rower_process_tpcallback,Tested in specific test suite,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+254,350,rower_process_twittercallback,Tested in specific test suite,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+255,351,set_language,Set language,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+256,352,SetOffsetView,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+257,353,stats,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+258,354,stats_json,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+259,355,jobs,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+260,356,workers,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+261,357,worker_details,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+262,358,finished_jobs,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+263,359,started_jobs,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+264,360,deferred_jobs,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+265,361,clear_queue,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+266,362,requeue_all,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+267,363,job_detail,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+268,364,delete_job,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+269,365,actions,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+270,366,requeue_job_view,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+271,367,enqueue_job,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+272,368,JavaScriptCatalog,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+273,369,serve,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+274,371,LoginView,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+275,372,LogoutView,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+276,373,PasswordChangeView,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+277,374,PasswordChangeDoneView,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+278,375,PasswordResetView,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+279,376,PasswordResetDoneView,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+280,377,PasswordResetConfirmView,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+281,378,PasswordResetCompleteView,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+282,386,index,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+283,387,login,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+284,388,logout,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+285,389,password_change,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+286,390,password_change_done,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+287,391,i18n_javascript,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+288,392,shortcut,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+289,393,changelist_view,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+290,394,add_view,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+291,395,autocomplete_view,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+292,396,history_view,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+293,397,delete_view,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+294,398,change_view,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+295,399,RedirectView,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+296,568,app_index,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+297,571,landingview,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+298,573,get_blog_posts,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+299,576,AuthorizationView,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+300,577,TokenView,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+301,578,WorkoutViewSet,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+302,582,RowerViewSet,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+303,586,FavoriteChartViewSet,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+304,590,APIRootView,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+305,592,SwaggerSchemaView,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+306,595,strokedatajson,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,TRUE,FALSE,FALSE,
+307,596,error500_view,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+308,603,failed_queue_view,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+309,604,failed_queue_empty,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,FALSE,FALSE,FALSE,
+310,605,failed_job_view,Other Apps views,TRUE,200,basic,200,302,basic,200,302,coach,200,302,FALSE,FALSE,TRUE,FALSE,FALSE,

rowers/tpstuff.py

@@ -42,6 +42,8 @@ oauth_data = {
     'scope':'write',
     }
 
+from rowers.rower_rules import is_workout_user
+
 
 # Checks if user has UnderArmour token, renews them if they are expired
 def tp_open(user):
@@ -171,7 +173,7 @@ def workout_tp_upload(user,w):
     # need some code if token doesn't refresh
 
 
-    if (checkworkoutuser(user,w)):
+    if (is_workout_user(user,w)):
         tcxfile = createtpworkoutdata(w)
         if tcxfile:
             res,reason,status_code,headers = uploadactivity(

rowers/traverselinktest.py

@@ -9,7 +9,7 @@ from django.test import TestCase, Client,override_settings
 from django.core.management import call_command
 from django.utils.six import StringIO
 from django.test.client import RequestFactory
-from .views import checkworkoutuser,c2_open
+from .views import c2_open
 from rowers.models import Workout, User, Rower, WorkoutForm,RowerForm,GraphImage
 from rowers.forms import DocumentsForm,CNsummaryForm,RegistrationFormUniqueEmail
 import rowers.plots as plots
@@ -55,12 +55,12 @@ class TraverseLinksTest(TestCase):
             name='testworkout',workouttype='On-water',
 	    user=self.r,date=nu.strftime('%Y-%m-%d'),
 	    starttime=nu.strftime('%H:%M:%S'),
-	    duration="0:55:00",distance=8000)        
+	    duration="0:55:00",distance=8000)
 	self.w2 = Workout.objects.create(
             name='testworkout 2',workouttype='On-water',
 	    user=self.r,date=nu.strftime('%Y-%m-%d'),
 	    starttime=nu.strftime('%H:%M:%S'),
-	    duration="0:55:00",distance=8000)        
+	    duration="0:55:00",distance=8000)
         if self.client.login(
                 username="superuser1", password="pwd"):
             if VERBOSE:

rowers/underarmourstuff.py

@@ -9,6 +9,7 @@ import numpy
 
 import rowers.mytypes as mytypes
 from rowers.mytypes import otwtypes
+from rowers.rower_rules import is_workout_user
 
 from rowsandall_app.settings import (
     UNDERARMOUR_CLIENT_KEY,
@@ -331,7 +332,7 @@ def workout_ua_upload(user,w):
 
     # ready to upload. Hurray
 
-    if (checkworkoutuser(user,w)):
+    if (is_workout_user(user,w)):
         data = createunderarmourworkoutdata(w)
 #        return HttpResponse(json.dumps(data))
         if not data:

rowers/uploads.py

@@ -14,6 +14,8 @@ from rowers.tasks import (
 
 from rowers.models import GraphImage
 
+from rowers.rower_rules import ispromember
+
 from PIL import Image
 
 import numpy as np
@@ -472,6 +474,8 @@ import rowers.runkeeperstuff as runkeeperstuff
 import rowers.underarmourstuff as underarmourstuff
 import rowers.tpstuff as tpstuff
 
+from rowers.rower_rules import is_promember
+
 def set_workouttype(w,options):
     try:
         w.workouttype = options['workouttype']
@@ -500,8 +504,6 @@ def make_private(w,options):
 
         return 1
 
-from rowers.utils import isprorower
-
 def do_sync(w,options):
     try:
         if options['stravaid'] != 0:
@@ -511,7 +513,7 @@ def do_sync(w,options):
     except KeyError:
         pass
 
-    if ('upload_to_C2' in options and options['upload_to_C2']) or (w.user.c2_auto_export and isprorower(w.user)):
+    if ('upload_to_C2' in options and options['upload_to_C2']) or (w.user.c2_auto_export and ispromember(w.user)):
         if ('upload_to_C2' in options and not options['upload_to_C2']):
             pass
         else:
@@ -521,7 +523,7 @@ def do_sync(w,options):
                 id = 0
                 message = "Something went wrong with the Concept2 sync"
 
-    if ('upload_to_Strava' in options and options['upload_to_Strava']) or (w.user.strava_auto_export and isprorower(w.user)):
+    if ('upload_to_Strava' in options and options['upload_to_Strava']) or (w.user.strava_auto_export and ispromember(w.user)):
         if ('upload_to_Strava' in options and not options['upload_to_Strava']):
             pass
         else:
@@ -534,7 +536,7 @@ def do_sync(w,options):
                 message = "Please connect to Strava first"
 
 
-    if ('upload_to_SportTracks' in options and options['upload_to_SportTracks']) or (w.user.sporttracks_auto_export and isprorower(w.user)):
+    if ('upload_to_SportTracks' in options and options['upload_to_SportTracks']) or (w.user.sporttracks_auto_export and ispromember(w.user)):
         if ('upload_to_SportTracks' in options and not options['upload_to_SportTracks']):
             pass
         else:
@@ -548,7 +550,7 @@ def do_sync(w,options):
                 id = 0
 
 
-    if ('upload_to_RunKeeper' in options and options['upload_to_RunKeeper']) or (w.user.runkeeper_auto_export and isprorower(w.user)):
+    if ('upload_to_RunKeeper' in options and options['upload_to_RunKeeper']) or (w.user.runkeeper_auto_export and ispromember(w.user)):
         if ('upload_to_RunKeeper' in options and not options['upload_to_RunKeeper']):
             pass
         else:
@@ -561,7 +563,7 @@ def do_sync(w,options):
                 message = "Please connect to Runkeeper first"
                 id = 0
 
-    if ('upload_to_MapMyFitness' in options and options['upload_to_MapMyFitness']) or (w.user.mapmyfitness_auto_export and isprorower(w.user)):
+    if ('upload_to_MapMyFitness' in options and options['upload_to_MapMyFitness']) or (w.user.mapmyfitness_auto_export and ispromember(w.user)):
         if ('upload_to_MapMyFitness' in options and not options['upload_to_MapMyFitness']):
             pass
         else:
@@ -574,7 +576,7 @@ def do_sync(w,options):
                 id = 0
 
 
-    if ('upload_to_TrainingPeaks' in options and options['upload_to_TrainingPeaks']) or (w.user.trainingpeaks_auto_export and isprorower(w.user)):
+    if ('upload_to_TrainingPeaks' in options and options['upload_to_TrainingPeaks']) or (w.user.trainingpeaks_auto_export and ispromember(w.user)):
         if ('upload_to_TrainingPeaks' in options and not options['upload_to_TrainingPeaks']):
             pass
         else:

rowers/urls.py

@@ -153,6 +153,8 @@ urlpatterns = [
         views.agegrouprecordview,name='agegrouprecordview'),
     re_path(r'^agegrouprecords/(?P<sex>\w+.*)/(?P<weightcategory>\w+.*)/$',
         views.agegrouprecordview,name='agegrouprecordview'),
+    re_path(r'^agegrouprecords/$',
+        views.agegrouprecordview,name='agegrouprecordview'),
     re_path(r'^list-workouts/ranking/$',views.workouts_view,{'rankingonly':True},
         name='workouts_view'),
 #    re_path(r'^list-workouts/team/(?P<teamid>\d+)/(?P<startdatestring>\d+-\d+-\d+)/(?P<enddatestring>\d+-\d+-\d+)/$',views.workouts_view,
@@ -191,7 +193,7 @@ urlpatterns = [
         views.virtualevent_submit_result_view,name='virtualevent_submit_result_view'),
     re_path(r'^virtualevent/(?P<id>\d+)/submit/(?P<workoutid>\b[0-9A-Fa-f]+\b)/$',
         views.virtualevent_submit_result_view,name='virtualevent_submit_result_view'),
-    re_path(r'^virtualevent/(?P<raceid>\d+)/disqualify/(?P<recordid>\d+)/',
+    re_path(r'^virtualevent/(?P<id>\d+)/disqualify/(?P<recordid>\d+)/',
         views.virtualevent_disqualify_view,name='virtualevent_disqualify_view'),
     re_path(r'^list-workouts/$',views.workouts_view,name='workouts_view'),
     re_path(r'^list-courses/$',views.courses_view,name='courses_view'),
@@ -218,6 +220,7 @@ urlpatterns = [
 #    re_path(r'^workouts-join-select/team/(?P<teamid>\d+)/(?P<startdatestring>\d+-\d+-\d+)/(?P<enddatestring>\d+-\d+-\d+)/$',views.workouts_join_select,
 #        name='workouts_join_select'),
     re_path(r'^workouts-join/$',views.workouts_join_view,name='workouts_join_view'),
+    re_path(r'^workouts-join/user/(?P<userid>\d+)$',views.workouts_join_view,name='workouts_join_view'),
     re_path(r'^workouts-join-select/team/(?P<teamid>\d+)/$',views.workouts_join_select,name='workouts_join_select'),
  #   re_path(r'^workouts-join-select/(?P<startdatestring>\d+-\d+-\d+)/(?P<enddatestring>\d+-\d+-\d+)/$',views.workouts_join_select,name='workouts_join_select'),
     re_path(r'^workouts-join-select/$',views.workouts_join_select,name='workouts_join_select'),
@@ -243,26 +246,27 @@ urlpatterns = [
     re_path(r'^record-progress/(?P<id>.*)/$',views.post_progress),
     re_path(r'^record-progress/$',views.post_progress),
     re_path(r'^list-graphs/$',views.graphs_view,name='graphs_view'),
+    re_path(r'^list-graphs/user/(?P<userid>\d+)/$',views.graphs_view,name='graphs_view'),
     re_path(r'^fitness-progress/$',views.fitnessmetric_view,name='fitnessmetric_view'),
-    re_path(r'^fitness-progress/user/(?P<id>\d+)/$',views.fitnessmetric_view,name='fitnessmetric_view'),
-    re_path(r'^fitness-progress/user/(?P<id>\d+)/(?P<mode>\w+.*)/$',views.fitnessmetric_view,name='fitnessmetric_view'),
+    re_path(r'^fitness-progress/user/(?P<userid>\d+)/$',views.fitnessmetric_view,name='fitnessmetric_view'),
+    re_path(r'^fitness-progress/user/(?P<userid>\d+)/(?P<mode>\w+.*)/$',views.fitnessmetric_view,name='fitnessmetric_view'),
 #    re_path(r'^ote-bests/user/(?P<theuser>\d+)/(?P<startdatestring>\d+-\d+-\d+)/(?P<enddatestring>\d+-\d+-\d+)/$',views.rankings_view,name='rankings_view'),
-    re_path(r'^ote-bests/user/(?P<theuser>\d+)/$',views.rankings_view,name='rankings_view'),
+    re_path(r'^ote-bests/user/(?P<userid>\d+)/$',views.rankings_view,name='rankings_view'),
 #    re_path(r'^ote-bests/(?P<startdatestring>\d+-\d+-\d+)/(?P<enddatestring>\d+-\d+-\d+)/$',views.rankings_view,name='rankings_view'),
     re_path(r'^ote-bests/$',views.rankings_view,name='rankings_view'),
-    re_path(r'^(?P<theuser>\d+)/ote-bests/$',views.rankings_view,name='rankings_view'),
+    re_path(r'^(?P<userid>\d+)/ote-bests/$',views.rankings_view,name='rankings_view'),
 #    re_path(r'^(?P<theuser>\d+)/ote-bests2/(?P<startdatestring>\d+-\d+-\d+)/(?P<enddatestring>\d+-\d+-\d+)/$',views.rankings_view2,name='rankings_view2'),
-    re_path(r'^ote-bests2/user/(?P<theuser>\d+)/$',views.rankings_view2,name='rankings_view2'),
+    re_path(r'^ote-bests2/user/(?P<userid>\d+)/$',views.rankings_view2,name='rankings_view2'),
 #    re_path(r'^ote-bests2/(?P<startdatestring>\d+-\d+-\d+)/(?P<enddatestring>\d+-\d+-\d+)/$',views.rankings_view2,name='rankings_view2'),
     re_path(r'^ote-bests2/$',views.rankings_view2,name='rankings_view2'),
 #    re_path(r'^otw-bests/user/(?P<theuser>\d+)/(?P<startdatestring>\d+-\d+-\d+)/(?P<enddatestring>\d+-\d+-\d+)/$',views.otwrankings_view,name='otwrankings_view'),
 #    re_path(r'^otw-bests/(?P<startdatestring>\d+-\d+-\d+)/(?P<enddatestring>\d+-\d+-\d+)/$',views.otwrankings_view,name='otwrankings_view'),
-    re_path(r'^otw-bests/user/(?P<theuser>\d+)/$',views.otwrankings_view,name='otwrankings_view'),
+    re_path(r'^otw-bests/user/(?P<userid>\d+)/$',views.otwrankings_view,name='otwrankings_view'),
     re_path(r'^otw-bests/$',views.otwrankings_view,name='otwrankings_view'),
 #    re_path(r'^ote-ranking/user/(?P<theuser>\d+)/(?P<startdatestring>\d+-\d+-\d+)/(?P<enddatestring>\d+-\d+-\d+)/$',views.oterankings_view,name='oterankings_view'),
 #    re_path(r'^ote-ranking/(?P<startdatestring>\d+-\d+-\d+)/(?P<enddatestring>\d+-\d+-\d+)/$',views.oterankings_view,name='oterankings_view'),
     re_path(r'^ote-ranking/$',views.oterankings_view,name='oterankings_view'),
-    re_path(r'^ote-ranking/user/(?P<theuser>\d+)/$',views.oterankings_view,name='oterankings_view'),
+    re_path(r'^ote-ranking/user/(?P<userid>\d+)/$',views.oterankings_view,name='oterankings_view'),
 #    re_path(r'^flexall/(?P<xparam>\w+.*)/(?P<yparam1>\w+.*)/(?P<yparam2>\w+.*)/(?P<startdatestring>\d+-\d+-\d+)/(?P<enddatestring>\d+-\d+-\d+)/user/(?P<theuser>\d+)/$',views.cum_flex,name='cum_flex'),
 #    re_path(r'^flexall/(?P<xparam>\w+.*)/(?P<yparam1>\w+.*)/(?P<yparam2>\w+.*)/(?P<startdatestring>\d+-\d+-\d+)/(?P<enddatestring>\d+-\d+-\d+)/$',views.cum_flex,name='cum_flex'),
     re_path(r'^flexall/(?P<xparam>\w+.*)/(?P<yparam1>\w+.*)/(?P<yparam2>\w+.*)/$',views.cum_flex,name='cum_flex'),
@@ -270,11 +274,11 @@ urlpatterns = [
     re_path(r'^flexall/user/(?P<theuser>\d+)/$',views.cum_flex,name='cum_flex'),
     re_path(r'^flexall/$',views.cum_flex,name='cum_flex'),
     re_path(r'^flexalldata/$',views.cum_flex_data,name='cum_flex_data'),
-    re_path(r'^histo/user/(?P<theuser>\d+)/$',views.histo,name='histo'),
+    re_path(r'^histo/user/(?P<userid>\d+)/$',views.histo,name='histo'),
     re_path(r'^histodata/$',views.histo_data,name='histo_data'),
 #    re_path(r'^histo/user/(?P<theuser>\d+)/(?P<startdatestring>\d+-\d+-\d+)/(?P<enddatestring>\d+-\d+-\d+)/$',views.histo,name='histo'),
     re_path(r'^histo/$',views.histo,name='histo'),
-    re_path(r'^cumstats/user/(?P<theuser>\d+)/$',views.cumstats,name='cumstats'),
+    re_path(r'^cumstats/user/(?P<userid>\d+)/$',views.cumstats,name='cumstats'),
 #    re_path(r'^cumstats/(?P<startdatestring>\d+-\d+-\d+)/(?P<enddatestring>\d+-\d+-\d+)/$',views.cumstats,name='cumstats'),
 #    re_path(r'^cumstats/user/(?P<theuser>\d+)/(?P<startdatestring>\d+-\d+-\d+)/(?P<enddatestring>\d+-\d+-\d+)/$',views.cumstats,name='cumstats'),
 #    re_path(r'^cumstats/(?P<startdatestring>\d+-\d+-\d+)/(?P<enddatestring>\d+-\d+-\d+)/$',views.cumstats,name='cumstats'),
@@ -289,8 +293,6 @@ urlpatterns = [
         name='otw_use_gps'),
     re_path(r'^workout/(?P<id>\b[0-9A-Fa-f]+\b)/toggle-ranking/$',views.workout_toggle_ranking,
         name='workout_toggle_ranking'),
-    re_path(r'^workout/(?P<id>\b[0-9A-Fa-f]+\b)/get-testscript/$',views.get_testscript,
-        name='get_testscript'),
     re_path(r'^workout/upload/team/$',views.team_workout_upload_view,name='team_workout_upload_view'),
     re_path(r'^workout/upload/$',views.workout_upload_view,name='workout_upload_view'),
     re_path(r'^workout/(?P<id>\b[0-9A-Fa-f]+\b)/histo/$',views.workout_histo_view,
@@ -355,6 +357,7 @@ urlpatterns = [
     re_path(r'^video/(?P<id>\w.+)/$',views.workout_video_view,
             name='workout_video_view'),
     re_path(r'^videos/',views.list_videos,name='list_videos'),
+    re_path(r'^add-video/user/(?P<userid>\d+)/$',views.video_selectworkout,name='video_selectworkout'),
     re_path(r'^add-video/',views.video_selectworkout,name='video_selectworkout'),
 #    re_path(r'^workout/(?P<id>\d+)/$',views.workout_view,name='workout_view'),
     re_path(r'^workout/(?P<id>\b[0-9A-Fa-f]+\b)/$',views.workout_view,name='workout_view'),
@@ -418,6 +421,7 @@ urlpatterns = [
     re_path(r'^workout/polarimport/user/(?P<userid>\d+)/',views.workout_polarimport_view,name='workout_polarimport_view'),
     re_path(r'^workout/runkeeperimport/$',views.workout_runkeeperimport_view,name='workout_runkeeperimport_view'),
     re_path(r'^workout/runkeeperimport/user/(?P<userid>\d+)/$',views.workout_runkeeperimport_view,name='workout_runkeeperimport_view'),
+    re_path(r'^workout/underarmourimport/user/(?P<userid>\d+)/$',views.workout_underarmourimport_view,name='workout_underarmourimport_view'),
     re_path(r'^workout/underarmourimport/$',views.workout_underarmourimport_view,name='workout_underarmourimport_view'),
 #    re_path(r'^workout/(?P<id>\b[0-9A-Fa-f]+\b)/deleteconfirm/$',views.workout_delete_confirm_view),
     re_path(r'^workout/(?P<id>\b[0-9A-Fa-f]+\b)/c2uploadw/$',views.workout_c2_upload_view,name='workout_c2_upload_view'),
@@ -458,12 +462,12 @@ urlpatterns = [
     re_path(r'^me/calcdps/$',views.rower_calcdps_view,name='rower_calcdps_view'),
     re_path(r'^me/exportsettings/$',views.rower_exportsettings_view,name='rower_exportsettings_view'),
     re_path(r'^me/exportsettings/user/(?P<userid>\d+)/$',views.rower_exportsettings_view,name='rower_exportsettings_view'),
-    re_path(r'^team/(?P<id>\d+)/$',views.team_view,name='team_view'),
-    re_path(r'^team/(?P<id>\d+)/memberstats/$',views.team_members_stats_view,name='team_members_stats_view'),
-    re_path(r'^team/(?P<id>\d+)/edit/$',views.team_edit_view,name='team_edit_view'),
+    re_path(r'^team/(?P<team_id>\d+)/$',views.team_view,name='team_view'),
+    re_path(r'^team/(?P<team_id>\d+)/memberstats/$',views.team_members_stats_view,name='team_members_stats_view'),
+    re_path(r'^team/(?P<team_id>\d+)/edit/$',views.team_edit_view,name='team_edit_view'),
     re_path(r'^team/(?P<id>\d+)/leaveconfirm/$',views.team_leaveconfirm_view,name='team_leaveconfirm_view'),
     re_path(r'^team/(?P<id>\d+)/leave/$',views.team_leave_view,name='team_leave_view'),
-    re_path(r'^team/(?P<id>\d+)/deleteconfirm/$',views.team_deleteconfirm_view,name='team_deleteconfirm_view'),
+    re_path(r'^team/(?P<team_id>\d+)/deleteconfirm/$',views.team_deleteconfirm_view,name='team_deleteconfirm_view'),
     re_path(r'^team/(?P<teamid>\d+)/requestmembership/(?P<userid>\d+)/$',views.team_requestmembership_view,name='team_requestmembership_view'),
     re_path(r'^me/coachrequest/(?P<id>\d+)/reject/$',views.reject_revoke_coach_request,
         name='reject_revoke_coach_request'),
@@ -489,7 +493,7 @@ urlpatterns = [
         name='coach_accept_coachrequest_view'),
     re_path(r'^me/coachoffer/(?P<code>\w+.*)/accept/$',views.rower_accept_coachoffer_view,
         name='rower_accept_coachoffer_view'),
-    re_path(r'^team/(?P<id>\d+)/delete/$',views.team_delete_view,name='team_delete_view'),
+    re_path(r'^team/(?P<team_id>\d+)/delete/$',views.team_delete_view,name='team_delete_view'),
     re_path(r'^team/create/$',views.team_create_view,name='team_create_view'),
     re_path(r'^me/team/(?P<teamid>\d+)/drop/(?P<userid>\d+)/$',views.manager_member_drop_view,name='manager_member_drop_view'),
     re_path(r'^me/invitation/(?P<id>\d+)/reject/$',views.invitation_reject_view,name='invitation_reject_view'),
@@ -535,10 +539,10 @@ urlpatterns = [
 #    re_path(r'^compatibility', TemplateView.as_view(template_name='compatibility.html'),name='about'),
 #    re_path(r'^videos', TemplateView.as_view(template_name='videos.html'),name='videos'),
     re_path(r'^analysis/user/(?P<userid>\d+)/$', views.analysis_view,name='analysis'),
-    re_path(r'^laboratory/user/(?P<userid>\d+)/$', views.laboratory_view,name='laboratory'),
+    re_path(r'^laboratory/$', views.laboratory_view,name='laboratory_view'),
+    re_path(r'^laboratory/user/(?P<userid>\d+)/$', views.laboratory_view,name='laboratory_view'),
     re_path(r'^errormessage/(?P<errormessage>[\w\ ]+.*)/$',views.errormessage_view,name='errormessage_view'),
     re_path(r'^analysis/$', views.analysis_view,name='analysis'),
-    re_path(r'^laboratory/$', views.laboratory_view,name='laboratory'),
     re_path(r'^promembership', TemplateView.as_view(template_name='promembership.html'),name='promembership'),
     re_path(r'^checkout/(?P<planid>\d+)/$',views.payment_confirm_view,name='payment_confirm_view'),
     re_path(r'^upgradecheckout/(?P<planid>\d+)/$',views.upgrade_confirm_view,name='upgrade_confirm_view'),
@@ -549,7 +553,7 @@ urlpatterns = [
     re_path(r'^downgrade/$',views.downgrade_view,name='downgrade'),
     re_path(r'^paymentcompleted/$',views.payment_completed_view,name='payment_completed_view'),
     re_path(r'^downgradecompleted/$',views.downgrade_completed_view,name='downgrade_completed_view'),
-    re_path(r'^paidplans/$',views.paidplans_view,name='paidplans'),
+    re_path(r'^paidplans/$',views.paidplans_view,name='paidplans_view'),
     re_path(r'^me/cancelsubscriptions/$',views.plan_stop_view,name='plan_stop_view'),
     re_path(r'^me/cancelsubscription/(?P<id>[\w\ ]+.*)/$',views.plan_tobasic_view,name='plan_tobasic_view'),
     re_path(r'^checkouts/$',views.checkouts_view,name='checkouts'),
@@ -574,7 +578,7 @@ urlpatterns = [
 #    re_path(r'^workout/compare/(?P<id1>\d+)/(?P<id2>\d+)/(?P<xparam>\w+.*)/(?P<yparam>[\w\ ]+.*)/$',views.workout_comparison_view2),
     re_path(r'^test\_callback',views.rower_process_testcallback,name='rower_process_testcallback'),
     re_path(r'^createplan/$',views.rower_create_trainingplan,name='rower_create_trainingplan'),
-    re_path(r'^createplan/user/(?P<userid>\d+)/$',views.rower_create_trainingplan,name='rower_create_trainingplan'),
+    re_path(r'^createplan/user/(?P<id>\d+)/$',views.rower_create_trainingplan,name='rower_create_trainingplan'),
     re_path(r'^deleteplan/(?P<pk>\d+)/$',login_required(
         views.TrainingPlanDelete.as_view()),name='trainingplan_delete_view'),
     re_path(r'^deletemicrocycle/(?P<pk>\d+)/$',login_required(
@@ -637,9 +641,9 @@ urlpatterns = [
     re_path(r'^sessions/teamcreate/team/$',
         views.plannedsession_teamcreate_view,
         name='plannedsession_teamcreate_view'),
-    re_path(r'^sessions/teamedit/(?P<sessionid>\d+)/$',views.plannedsession_teamedit_view,
+    re_path(r'^sessions/teamedit/(?P<id>\d+)/$',views.plannedsession_teamedit_view,
         name='plannedsession_teamedit_view'),
-    re_path(r'^sessions/teamedit/(?P<sessionid>\d+)/user/(?P<userid>\d+)/$',
+    re_path(r'^sessions/teamedit/(?P<id>\d+)/user/(?P<userid>\d+)/$',
         views.plannedsession_teamedit_view,
         name='plannedsession_teamedit_view'),
     re_path(r'^sessions/create/$',views.plannedsession_create_view,
@@ -653,7 +657,7 @@ urlpatterns = [
 #    re_path(r'^sessions/create/(?P<startdatestring>\d+-\d+-\d+)/(?P<enddatestring>\d+-\d+-\d+)/user/(?P<userid>\d+)/$',
 #        views.plannedsession_create_view,
 #        name='plannedsession_create_view'),
-    re_path(r'^sessions/multiclone/$',views.plannedsession_multiclone_view),
+    re_path(r'^sessions/multiclone/$',views.plannedsession_multiclone_view,name='plannedsession_multiclone_view'),
     re_path(r'^sessions/multiclone/user/(?P<userid>\d+)/$',
         views.plannedsession_multiclone_view,
         name='plannedsession_multiclone_view'),
@@ -717,7 +721,7 @@ urlpatterns = [
     re_path(r'^sessions/print/user/(?P<userid>\d+)/$',views.plannedsessions_print_view,
         name='plannedsessions_print_view'),
     re_path(r'^sessions/sendcalendar/$',views.plannedsessions_icsemail_view,
-        name='plannedsessions_icsemail_view'),
+        name='plannedsessions_coach_icsemail_view'),
     re_path(r'^sessions/sendcalendar/user/(?P<userid>\d+)/$',views.plannedsessions_icsemail_view,
         name='plannedsessions_icsemail_view'),
     re_path(r'^sessions/$',views.plannedsessions_view,

rowers/utils.py

@@ -109,7 +109,7 @@ def get_call():
     </p>
 </div>
 """ % (call1, call2)
-    
+
     return call
 
 def absolute(request):
@@ -131,7 +131,7 @@ def trcolors(r1,g1,b1,r2,g2,b2):
     h1,s1,v1 = colorsys.rgb_to_hsv(r1,g1,b1)
     h2,s2,v2 = colorsys.rgb_to_hsv(r2,g2,b2)
 
-    
+
     return 360*h1,360*(h2-h1),s1,(s2-s1),v1,(v2-v1)
 
 palettes = {
@@ -167,7 +167,7 @@ def is_ranking_piece(workout):
         return True
     elif workout.duration in rankingdurations:
         return True
-    
+
     return False
 
 def range_to_color_hex(groupcols,palette='monochrome_blue'):
@@ -176,20 +176,20 @@ def range_to_color_hex(groupcols,palette='monochrome_blue'):
     plt = palettes[palette]
   except KeyError:
     plt = palettes['monochrome_blue']
-    
+
   rgb = [colorsys.hsv_to_rgb((plt[0]+plt[1]*x)/360.,
                              plt[2]+plt[3]*x,
                              plt[4]+plt[5]*x) for x in groupcols]
 
   RGB = [(int(255.*r),int(255.*g),int(255.*b)) for (r, g, b) in rgb]
   colors = ["#%02x%02x%02x" % (r, g, b) for (r, g, b) in RGB]
-  
+
   return colors
 
 def str2bool(v):
   return v.lower() in ("yes", "true", "t", "1")
 
-def uniqify(seq, idfun=None): 
+def uniqify(seq, idfun=None):
    # order preserving
    if idfun is None:
        def idfun(x): return x
@@ -222,12 +222,12 @@ def geo_distance(lat1,lon1,lat2,lon2):
     This is a slight underestimate but is close enough for our purposes,
     We're never moving more than 10 meters between trackpoints
 
-    Bearing calculation fails if one of the points is a pole. 
-    (Hey, from the North pole you can walk South, East, North and end up 
+    Bearing calculation fails if one of the points is a pole.
+    (Hey, from the North pole you can walk South, East, North and end up
     on the same spot!)
-    
+
     """
-    
+
     # radius of our earth in km --> should be moved to settings if
     # rowing takes off on other planets
     R = 6373.0
@@ -257,7 +257,7 @@ def geo_distance(lat1,lon1,lat2,lon2):
 
     return [distance,bearing]
 
-        
+
 
 def isbreakthrough(delta,cpvalues,p0,p1,p2,p3,ratio):
   pwr = abs(p0)/(1+(delta/abs(p2)))
@@ -268,7 +268,7 @@ def isbreakthrough(delta,cpvalues,p0,p1,p2,p3,ratio):
 
   pwr *= ratio
 
-  
+
   delta = delta.values.astype(int)
   cpvalues = cpvalues.values.astype(int)
   pwr = pwr.astype(int)
@@ -276,7 +276,7 @@ def isbreakthrough(delta,cpvalues,p0,p1,p2,p3,ratio):
   res = np.sum(cpvalues>pwr)
   res2 = np.sum(cpvalues>pwr2)
 
-  
+
   btdf = pd.DataFrame(
     {
       'delta':delta[cpvalues>pwr],
@@ -288,7 +288,7 @@ def isbreakthrough(delta,cpvalues,p0,p1,p2,p3,ratio):
 
   btdf.sort_values('delta',axis=0,inplace=True)
 
-  
+
   return res>1,btdf,res2>1
 
 
@@ -300,7 +300,7 @@ def myqueue(queue,function,*args,**kwargs):
 
         def revoke(self):
             return 1
-    
+
     if settings.TESTING:
         return MockJob()
     elif settings.CELERY:
@@ -310,7 +310,7 @@ def myqueue(queue,function,*args,**kwargs):
     else:
         if settings.DEBUG:
             kwargs['debug'] = True
-            
+
         job_id = str(uuid.uuid4())
         kwargs['job_id'] = job_id
         kwargs['jobkey'] = job_id
@@ -335,7 +335,7 @@ def my_dict_from_instance(instance,model):
     thedict['id'] = instance.id
 
     for f in instance._meta.fields:
-        
+
         fname = f.name
 
         try:
@@ -405,24 +405,13 @@ def totaltime_sec_to_string(totaltime):
 
     return duration
 
-def isprorower(r):
-    result = False
-    result = r.rowerplan in ['pro','coach','plan']
-
-    if not result and r.protrialexpires:
-        result = r.rowerplan == 'basic' and r.protrialexpires >= datetime.date.today()
-    if not result and r.rowerplan == 'freecoach':
-        if r.mycoachgroup is not None:
-            result = len(r.mycoachgroup)>=4
-
-    return result
 
 def iscoach(m,r):
     result = False
     result = m in r.coaches
 
     return result
-                                                                                     
+
 # Exponentially weighted moving average
 # Used for data smoothing of the jagged data obtained by Strava
 # See bitbucket issue 72
@@ -433,7 +422,7 @@ def ewmovingaverage(interval,window_size):
         intervaldf = pd.DataFrame({'v':interval})
         idf_ewma1 = intervaldf.ewm(span=window_size)
         idf_ewma2 = intervaldf[::-1].ewm(span=window_size)
-        
+
         i_ewma1 = idf_ewma1.mean().loc[:,'v']
         i_ewma2 = idf_ewma2.mean().loc[:,'v']
 
@@ -478,7 +467,7 @@ def custom_exception_handler(exc,message):
     res.json = json.dumps(response)
 
     return res
-    
+
 def get_strava_stream(r,metric,stravaid,series_type='time',fetchresolution='high'):
     authorizationstring = str('Bearer ' + r.stravatoken)
     headers = {'Authorization': authorizationstring,
@@ -503,7 +492,7 @@ def get_strava_stream(r,metric,stravaid,series_type='time',fetchresolution='high
                 return  np.array(data['data'])
         except TypeError:
             return None
-            
+
     return None
 
 def allmonths(startdate,enddate):
@@ -518,4 +507,3 @@ def allsundays(startdate,enddate):
     while d<=enddate:
         yield d
         d += datetime.timedelta(days=7)
-        

rowers/views/analysisviews.py

@@ -33,6 +33,7 @@ defaultoptions = {
 @user_passes_test(ispromember, login_url="/rowers/paidplans",
                   message="This functionality requires a Pro plan or higher. If you are already a Pro user, please log in to access this functionality",
                   redirect_field_name=None)
+@permission_required('rower.is_coach',fn=get_user_by_userid,raise_exception=True)
 def analysis_new(request,userid=0,function='boxplot',teamid=0):
     r = getrequestrower(request, userid=userid)
     user = r.user
@@ -669,6 +670,7 @@ def boxplotdata(workouts,options):
 @user_passes_test(ispromember,login_url="/rowers/paidplans",
                   message="This functionality requires a Pro plan or higher. If you are already a Pro user, please log in to access this functionality",
                   redirect_field_name=None)
+@permission_required('rower.is_coach',fn=get_user_by_userid,raise_exception=True)
 def analysis_view_data(request,userid=0):
     if not request.is_ajax():
         url = reverse('analysis_new')
@@ -727,7 +729,8 @@ def analysis_view_data(request,userid=0):
 @user_passes_test(ispromember,login_url="/rowers/paidplans",
                   message="This functionality requires a Pro plan or higher. If you are already a Pro user, please log in to access this functionality",
                   redirect_field_name=None)
-def histo(request,theuser=0,
+@permission_required('rower.is_coach',fn=get_user_by_userid,raise_exception=True)
+def histo(request,userid=0,
           startdate=timezone.now()-datetime.timedelta(days=365),
           enddate=timezone.now(),
           deltadays=-1,
@@ -741,7 +744,7 @@ def histo(request,theuser=0,
               'histoparam':'power'
           }):
 
-    r = getrequestrower(request,userid=theuser)
+    r = getrequestrower(request,userid=userid)
     theuser = r.user
 
     if 'histoparam' in request.session:
@@ -1327,17 +1330,18 @@ def cum_flex(request,theuser=0,
 def planrequired_view(request):
     messages.info(request,"This functionality requires Coach or Self-Coach membership")
 
-    return HttpResponseRedirect(reverse('paidplans'))
+    return HttpResponseRedirect(reverse('paidplans_view'))
 
-@user_passes_test(hasplannedsessions,login_url="/rowers/paidplans",
+@user_passes_test(isplanmember,login_url="/rowers/paidplans",
                   message="This functionality requires a Coach or Self-Coach plan",
                   redirect_field_name=None)
-def fitnessmetric_view(request,id=0,mode='rower',
+@permission_required('rower.is_coach',fn=get_user_by_userid,raise_exception=True)
+def fitnessmetric_view(request,userid=0,mode='rower',
                        startdate=timezone.now()-timezone.timedelta(days=365),
                        enddate=timezone.now()):
 
 
-    therower = getrequestrower(request,userid=id)
+    therower = getrequestrower(request,userid=userid)
     theuser = therower.user
 
 
@@ -1387,7 +1391,8 @@ def fitnessmetric_view(request,id=0,mode='rower',
 
 # Show ranking distances including predicted paces
 @login_required()
-def rankings_view(request,theuser=0,
+@permission_required('rower.is_coach',fn=get_user_by_userid,raise_exception=True)
+def rankings_view(request,userid=0,
           startdate=timezone.now()-datetime.timedelta(days=365),
           enddate=timezone.now(),
           deltadays=-1,
@@ -1408,25 +1413,25 @@ def rankings_view(request,theuser=0,
         enddate = startdate
         startdate = s
 
-    if theuser == 0:
-        theuser = request.user.id
+
 
     promember=0
-    if not request.user.is_anonymous:
-        r = getrower(request.user)
-        if r.birthdate:
-            age = calculate_age(r.birthdate)
-            worldclasspower = int(metrics.getagegrouprecord(
-                age,
-                sex=r.sex,
-                weightcategory=r.weightcategory,
-            ))
-        else:
-            worldclasspower = None
+    r = getrequestrower(request,userid=userid)
+    theuser = r.user.id
 
-        result = request.user.is_authenticated and ispromember(request.user)
-        if result:
-            promember=1
+    if r.birthdate:
+        age = calculate_age(r.birthdate)
+        worldclasspower = int(c2stuff.getagegrouprecord(
+            age,
+            sex=r.sex,
+            weightcategory=r.weightcategory,
+        ))
+    else:
+        worldclasspower = None
+
+    result = request.user.is_authenticated and ispromember(request.user)
+    if result:
+        promember=1
 
     # get all indoor rows in date range
 
@@ -1737,7 +1742,8 @@ def ajax_agegrouprecords(request,
 
 # Show ranking distances including predicted paces
 @login_required()
-def rankings_view2(request,theuser=0,
+@permission_required('rower.is_coach',fn=get_user_by_userid,raise_exception=True)
+def rankings_view2(request,userid=0,
           startdate=timezone.now()-datetime.timedelta(days=365),
           enddate=timezone.now(),
           deltadays=-1,
@@ -1758,83 +1764,84 @@ def rankings_view2(request,theuser=0,
         enddate = startdate
         startdate = s
 
-    if theuser == 0:
-        theuser = request.user.id
+    if userid == 0:
+        userid = request.user.id
     else:
         lastupdated = "01-01-1900"
 
 
     promember=0
-    if not request.user.is_anonymous:
-        r = getrower(request.user)
+    r = getrequestrower(request,userid=userid)
+    theuser = r.user
+
+    wcdurations = []
+    wcpower = []
+
+    lastupdated = "01-01-1900"
+    userid = 0
+    if 'options' in request.session:
+        options = request.session['options']
+        try:
+            wcdurations = options['wcdurations']
+            wcpower = options['wcpower']
+            lastupdated = options['lastupdated']
+        except KeyError:
+            pass
+        try:
+            userid = options['userid']
+        except KeyError:
+            userid = 0
+    else:
+        options = {}
+
+
+
+    lastupdatedtime = arrow.get(lastupdated).timestamp
+    current_time = arrow.utcnow().timestamp
+
+    deltatime_seconds = current_time - lastupdatedtime
+    recalc = False
+    if str(userid) != str(theuser) or deltatime_seconds > 3600:
+        recalc = True
+        options['lastupdated'] = arrow.utcnow().isoformat()
+    else:
+        recalc = False
+
+    options['userid'] = theuser.id
+
+    if r.birthdate:
+        age = calculate_age(r.birthdate)
+    else:
+        worldclasspower = None
+        age = 0
+
+    agerecords = CalcAgePerformance.objects.filter(
+        age = age,
+        sex = r.sex,
+        weightcategory = r.weightcategory)
+
+    if len(agerecords) == 0:
+        recalc = True
+        wcpower = []
+        wcduration = []
+    else:
         wcdurations = []
         wcpower = []
+        for record in agerecords:
+            wcdurations.append(record.duration)
+            wcpower.append(record.power)
 
-        lastupdated = "01-01-1900"
-        userid = 0
-        if 'options' in request.session:
-            options = request.session['options']
-            try:
-                wcdurations = options['wcdurations']
-                wcpower = options['wcpower']
-                lastupdated = options['lastupdated']
-            except KeyError:
-                pass
-            try:
-                userid = options['userid']
-            except KeyError:
-                userid = 0
-        else:
-            options = {}
+    options['wcpower'] = wcpower
+    options['wcdurations'] = wcdurations
+    if theuser:
+        options['userid'] = theuser.id
+
+    request.session['options'] = options
 
 
-
-        lastupdatedtime = arrow.get(lastupdated).timestamp
-        current_time = arrow.utcnow().timestamp
-
-        deltatime_seconds = current_time - lastupdatedtime
-        recalc = False
-        if str(userid) != str(theuser) or deltatime_seconds > 3600:
-            recalc = True
-            options['lastupdated'] = arrow.utcnow().isoformat()
-        else:
-            recalc = False
-
-        options['userid'] = theuser
-
-        if r.birthdate:
-            age = calculate_age(r.birthdate)
-        else:
-            worldclasspower = None
-            age = 0
-
-        agerecords = CalcAgePerformance.objects.filter(
-            age = age,
-            sex = r.sex,
-            weightcategory = r.weightcategory)
-
-        if len(agerecords) == 0:
-            recalc = True
-            wcpower = []
-            wcduration = []
-        else:
-            wcdurations = []
-            wcpower = []
-            for record in agerecords:
-                wcdurations.append(record.duration)
-                wcpower.append(record.power)
-
-        options['wcpower'] = wcpower
-        options['wcdurations'] = wcdurations
-        if theuser:
-            options['userid'] = theuser
-
-        request.session['options'] = options
-
-
-        result = request.user.is_authenticated and ispromember(request.user)
-        if result:
-            promember=1
+    result = request.user.is_authenticated and ispromember(request.user)
+    if result:
+        promember=1
 
     # get all indoor rows in date range
 
@@ -1883,10 +1890,7 @@ def rankings_view2(request,theuser=0,
         r=0
 
 
-    try:
-        uu = User.objects.get(id=theuser)
-    except User.DoesNotExist:
-        uu = ''
+    uu = theuser
 
 
     # test to fix bug
@@ -2150,7 +2154,8 @@ def rankings_view2(request,theuser=0,
 @user_passes_test(ispromember,login_url="/rowers/paidplans",
                   message="This functionality requires a Pro plan or higher. If you are already a Pro user, please log in to access this functionality",
                   redirect_field_name=None)
-def otwrankings_view(request,theuser=0,
+@permission_required('rower.is_coach',fn=get_user_by_userid,raise_exception=True)
+def otwrankings_view(request,userid=0,
                      startdate=timezone.now()-datetime.timedelta(days=365),
                      enddate=timezone.now(),
                      startdatestring="",
@@ -2173,22 +2178,10 @@ def otwrankings_view(request,theuser=0,
         enddate = startdate
         startdate = s
 
-    if theuser == 0:
-        if 'rowerid' in request.session:
-            try:
-                r = Rower.objects.get(id=request.session['rowerid'])
-                theuser = r.user.id
-            except Rower.DoesNotExist:
-                theuser = request.user.id
-        else:
-            theuser = request.user.id
+    r = getrequestrower(request,userid=userid)
+    promember = True
 
-    promember=0
-    if not request.user.is_anonymous:
-        r = Rower.objects.get(user=request.user)
-        result = request.user.is_authenticated and ispromember(request.user)
-        if result:
-            promember=1
+    theuser = r.user
 
     # get all OTW rows in date range
 
@@ -2242,10 +2235,7 @@ def otwrankings_view(request,theuser=0,
 
 
 
-    try:
-        uu = User.objects.get(id=theuser)
-    except User.DoesNotExist:
-        uu = ''
+    uu = theuser
 
 
     # test to fix bug
@@ -2555,7 +2545,8 @@ def otwcp_toadmin_view(request,theuser=0,
 @user_passes_test(ispromember,login_url="/rowers/paidplans",
                   message="This functionality requires a Pro plan or higher. If you are already a Pro user, please log in to access this functionality",
                   redirect_field_name=None)
-def oterankings_view(request,theuser=0,
+@permission_required('rower.is_coach',fn=get_user_by_userid,raise_exception=True)
+def oterankings_view(request,userid=0,
                      startdate=timezone.now()-datetime.timedelta(days=365),
                      enddate=timezone.now(),
                      startdatestring="",
@@ -2578,23 +2569,11 @@ def oterankings_view(request,theuser=0,
         enddate = startdate
         startdate = s
 
-    if theuser == 0:
-        if 'rowerid' in request.session:
-            try:
-                r = Rower.objects.get(id=request.session['rowerid'])
-                theuser = r.user.id
-            except Rower.DoesNotExist:
-                theuser = request.user.id
-        else:
-            theuser = request.user.id
+    r = getrequestrower(request,userid=userid)
+    theuser = r.user
 
 
     promember=0
-    if not request.user.is_anonymous:
-        r = Rower.objects.get(user=request.user)
-        result = request.user.is_authenticated and ispromember(request.user)
-        if result:
-            promember=1
 
     # get all OTW rows in date range
 
@@ -2668,10 +2647,8 @@ def oterankings_view(request,theuser=0,
         raise Http404("Rower doesn't exist")
 
 
-    try:
-        uu = User.objects.get(id=theuser)
-    except User.DoesNotExist:
-        uu = ''
+    uu = theuser
+
 
 
     # test to fix bug
@@ -2906,6 +2883,7 @@ def oterankings_view(request,theuser=0,
 @user_passes_test(ispromember,login_url="/rowers/paidplans",
                   message="This functionality requires a Pro plan or higher. If you are already a Pro user, please log in to access this functionality",
                   redirect_field_name=None)
+@permission_required('rower.is_coach',fn=get_user_by_userid,raise_exception=True)
 def user_multiflex_select(request,
                           startdatestring="",
                           enddatestring="",
@@ -3112,6 +3090,7 @@ def user_multiflex_select(request,
 @user_passes_test(ispromember,login_url="/rowers/paidplans",
                   message="This functionality requires a Pro plan or higher. If you are already a Pro user, please log in to access this functionality",
                   redirect_field_name=None)
+@permission_required('rower.is_coach',fn=get_user_by_userid,raise_exception=True)
 def multiflex_data(request,userid=0,
                  options={
                      'includereststrokes':False,
@@ -3365,6 +3344,7 @@ def multiflex_data(request,userid=0,
 @user_passes_test(ispromember,login_url="/rowers/paidplans",
                   message="This functionality requires a Pro plan or higher. If you are already a Pro user, please log in to access this functionality",
                   redirect_field_name=None)
+@permission_required('rower.is_coach',fn=get_user_by_userid,raise_exception=True)
 def multiflex_view(request,userid=0,
                  options={
                      'includereststrokes':False,
@@ -3532,6 +3512,7 @@ def multiflex_view(request,userid=0,
 @user_passes_test(ispromember,login_url="/rowers/paidplans",
                   message="This functionality requires a Pro plan or higher. If you are already a Pro user, please log in to access this functionality",
                   redirect_field_name=None)
+@permission_required('rower.is_coach',fn=get_user_by_userid,raise_exception=True)
 def user_boxplot_select(request,
                         startdatestring="",
                         enddatestring="",
@@ -3740,6 +3721,7 @@ def user_boxplot_select(request,
 @user_passes_test(ispromember,login_url="/rowers/paidplans",
                   message="This functionality requires a Pro plan or higher. If you are already a Pro user, please log in to access this functionality",
                   redirect_field_name=None)
+@permission_required('rower.is_coach',fn=get_user_by_userid,raise_exception=True)
 def boxplot_view_data(request,userid=0,
                  options={
                      'includereststrokes':False,
@@ -3857,6 +3839,7 @@ def boxplot_view_data(request,userid=0,
 @user_passes_test(ispromember,login_url="/rowers/paidplans",
                   message="This functionality requires a Pro plan or higher. If you are already a Pro user, please log in to access this functionality",
                   redirect_field_name=None)
+@permission_required('rower.is_coach',fn=get_user_by_userid,raise_exception=True)
 def boxplot_view(request,userid=0,
                  options={
                      'includereststrokes':False,
@@ -3975,7 +3958,8 @@ def boxplot_view(request,userid=0,
 
 # Cumulative stats page
 @user_passes_test(ispromember,login_url="/rowers/paidplans",message="This functionality requires a Pro plan or higher. If you are already a Pro user, please log in to access this functionality",redirect_field_name=None)
-def cumstats(request,theuser=0,
+@permission_required('rower.is_coach',fn=get_user_by_userid,raise_exception=True)
+def cumstats(request,userid=0,
              startdate=timezone.now()-datetime.timedelta(days=30),
              enddate=timezone.now(),
              deltadays=-1,
@@ -3988,7 +3972,7 @@ def cumstats(request,theuser=0,
                  'rankingonly':False,
              }):
 
-    r = getrequestrower(request,userid=theuser)
+    r = getrequestrower(request,userid=userid)
     theuser = r.user
 
     if 'waterboattype' in request.session:
@@ -4106,7 +4090,7 @@ def cumstats(request,theuser=0,
 
     options = {
         'modality': modality,
-        'theuser': theuser.id,
+        'userid': theuser.id,
         'waterboattype':waterboattype,
         'startdatestring':startdatestring,
         'enddatestring':enddatestring,
@@ -4326,6 +4310,7 @@ def agegrouprecordview(request,sex='male',weightcategory='hwt',
 #                  message="This functionality requires a Pro plan or higher. If you are already a Pro user, please log in to access this functionality",
 #                  redirect_field_name=None)
 @login_required
+@permission_required('rower.is_coach',fn=get_user_by_userid,raise_exception=True)
 def alerts_view(request,userid=0):
     r = getrequestrower(request,userid=userid)
 
@@ -4360,6 +4345,7 @@ def alerts_view(request,userid=0):
 @user_passes_test(ispromember, login_url="/rowers/paidplans",
                   message="This functionality requires a Pro plan or higher. If you are already a Pro user, please log in to access this functionality",
                   redirect_field_name=None)
+@permission_required('rower.is_coach',fn=get_user_by_userid,raise_exception=True)
 def alert_create_view(request,userid=0):
     r = getrequestrower(request,userid=userid)
     FilterFormSet = formset_factory(ConditionEditForm, formset=BaseConditionFormSet,extra=1)
@@ -4438,6 +4424,7 @@ def alert_create_view(request,userid=0):
 
 # alert report view
 @login_required()
+@permission_required('rower.is_coach',fn=get_user_by_userid,raise_exception=True)
 def alert_report_view(request,id=0,userid=0,nperiod=0):
     r = getrequestrower(request,userid=userid)
     if userid == 0:
@@ -4495,6 +4482,7 @@ def alert_report_view(request,id=0,userid=0,nperiod=0):
 @user_passes_test(ispromember, login_url="/rowers/paidplans",
                   message="This functionality requires a Pro plan or higher. If you are already a Pro user, please log in to access this functionality",
                   redirect_field_name=None)
+@permission_required('rower.is_coach',fn=get_user_by_userid,raise_exception=True)
 def alert_edit_view(request,id=0,userid=0):
     r = getrequestrower(request,userid=userid)
 

rowers/views/exportviews.py

@@ -1,18 +1,17 @@
 from rowers.views.statements import *
 
 
-    
+
 
 
 
 # Export workout to TCX and send to user's email address
-@login_required()
+@permission_required('workout.change_workout',fn=get_workout_by_opaqueid,raise_exception=True)
 def workout_tcxemail_view(request,id=0):
     r = getrower(request.user)
     w = get_workout(id)
 
-    if not checkworkoutuser(request.user,w):
-        raise PermissionDenied("Access denied")
+
 
 
     row = rdata(w.csvfilename)
@@ -31,8 +30,8 @@ def workout_tcxemail_view(request,id=0):
     return response
 
 
-		      
-    
+
+
 
 @login_required()
 def plannedsessions_icsemail_view(request,userid=0):
@@ -66,7 +65,7 @@ def plannedsessions_icsemail_view(request,userid=0):
         d1 = startdate.strftime("%Y%m%d"),
         d2 = enddate.strftime("%Y%m%d"),
         )
-        
+
     response['Content-Type'] = 'application/octet-stream'
 
     return response
@@ -96,7 +95,7 @@ def plannedsessions_coach_icsemail_view(request,userid=0):
             rowers += ps.rower.filter(team__in=rteams).exclude(rowerplan='freecoach')
 
     rowers = list(set(rowers))
-    
+
     cal = Calendar()
     cal.add('prodid','rowsandall')
     cal.add('version','1.0')
@@ -169,13 +168,12 @@ def course_kmldownload_view(request,id=0):
 
 
 # Export workout to GPX and send to user's email address
-@login_required()
+@permission_required('workout.change_workout',fn=get_workout_by_opaqueid,raise_exception=True)
 def workout_gpxemail_view(request,id=0):
     r = getrower(request.user)
     w = get_workout(id)
 
-    if not checkworkoutuser(request.user,w):
-        raise PermissionDenied("Access denied")
+
 
 
     row = rdata(w.csvfilename)
@@ -233,17 +231,16 @@ def workouts_summaries_email_view(request):
                   {
                       'form':form
                       })
-    
+
 
 # Get Workout CSV file and send it to user's email address
-@login_required()
+@permission_required('workout.change_workout',fn=get_workout_by_opaqueid,raise_exception=True)
 def workout_csvemail_view(request,id=0):
     r = getrower(request.user)
 
     w = get_workout(id)
 
-    if not checkworkoutuser(request.user,w):
-        raise PermissionDenied("Access denied")
+
 
     rowdata = rdata(w.csvfilename)
     code = str(uuid4())
@@ -252,18 +249,22 @@ def workout_csvemail_view(request,id=0):
     rowdate = rowdata.rowdatetime
     starttimeunix = arrow.get(rowdate).timestamp
     df = rowdata.df
-    df[' ElapsedTime (sec)'] = df['TimeStamp (sec)']
-    df['TimeStamp (sec)'] = df['TimeStamp (sec)'] + starttimeunix
-    
+    try:
+        df[' ElapsedTime (sec)'] = df['TimeStamp (sec)']
+        df['TimeStamp (sec)'] = df['TimeStamp (sec)'] + starttimeunix
+    except KeyError:
+	    pass
+
     response = HttpResponse(df.to_csv())
     response['Content-Disposition'] = 'attachment; filename="%s"' % filename
     response['Content-Type'] = 'application/octet-stream'
 
     return response
-        
+
 
 # Get Workout CSV file and send it to user's email address
 @login_required()
+@permission_required('rower.is_staff',fn=get_user_by_userid,raise_exception=True)
 def workout_csvtoadmin_view(request,id=0):
     message = ""
     r = getrower(request.user)

rowers/views/otherviews.py

@@ -49,8 +49,8 @@ def failed_queue_empty(request):
     q.empty()
 
     return HttpResponseRedirect(reverse('failed_queue_view'))
-    
-    
+
+
 @login_required()
 def failed_job_view(request,id=0):
     if not request.user.is_staff:
@@ -62,7 +62,7 @@ def failed_job_view(request,id=0):
     thejob.delete()
 
     return HttpResponseRedirect(reverse('failed_queue_view'))
-    
+
 
 @login_required()
 def errormessage_view(request,errormessage='aap'):
@@ -74,123 +74,10 @@ def errormessage_view(request,errormessage='aap'):
         "result":1,
         })
 
-@login_required()
-def deactivate_user(request):
-    pk = request.user.id
-    user = User.objects.get(pk=pk)
-    user_form = DeactivateUserForm(instance=user)
-    if request.user.is_authenticated and request.user.id == user.id:
-        if request.method == "POST":
-            user_form = DeactivateUserForm(request.POST, instance=user)
-            if user_form.is_valid():
-                if not user_form.cleaned_data['is_active']:
-                    r = Rower.objects.get(user=user)
-                    if r.paidplan is not None and r.paidplan.paymentprocessor == 'braintree':
-                        try:
-                            subscriptions = braintreestuff.find_subscriptions(r)
-                            for subscription in subscriptions:
-                                success, themessages,errormessages = braintreestuff.cancel_subscription(r,id)
-                                for message in themessages:
-                                    messages.info(request,message)
-                        except ProcessorCustomerError:
-                            pass
-
-                        r.paidplan = None
-                        r.teamplanexpires = timezone.now()
-                        r.planexpires = timezone.now()
-                        r.clubsize = 0
-                        r.rowerplan = 'basic'
-                        r.save()
-
-                    deactivate_user = user_form.save(commit=False)
-                    user.is_active = False
-                    user.save()
-                    deactivate_user.save()
-                    #                url = reverse(auth_views.logout_then_login)
-                    url = '/logout/?next=/login'
-                    return HttpResponseRedirect(url)
-                
-        return render(request, "userprofile_deactivate.html", {
-            "user_form": user_form,
-        })
-    else:
-        raise PermissionDenied    
-
-@login_required()
-def user_gdpr_optin(request):
-    r = getrower(request.user)
-    r.gdproptin = False
-    r.gdproptindate = None
-    r.save()
-    nexturl = request.GET.get('next','/rowers/list-workouts/')
-    if r.gdproptin:
-        return HttpResponseRedirect(nexturl)
-
-    return render(request,'gdpr_optin.html',{
-        "next": nexturl
-        })
-
-@login_required()
-def user_gdpr_confirm(request):
-    r = getrower(request.user)
-    r.gdproptin = True
-    r.gdproptindate = timezone.now()
-    r.save()
-
-    nexturl = request.GET.get('next','/rowers/list-workouts/')
-
-    return HttpResponseRedirect(nexturl)
-                  
-        
-    
-@login_required()
-def remove_user(request):
-    pk = request.user.id
-    user = User.objects.get(pk=pk)
-    user_form = DeleteUserForm(instance=user)
-    if request.user.is_authenticated and request.user.id == user.id:
-        if request.method == "POST":
-            user_form = DeleteUserForm(request.POST,instance=user)
-            if user_form.is_valid():
-                cd = user_form.cleaned_data
-                name = user.first_name+' '+user.last_name
-                email = user.email
-
-                r = Rower.objects.get(user=user)
-                if r.paidplan is not None and r.paidplan.paymentprocessor == 'braintree':
-                    try:
-                        subscriptions = braintreestuff.find_subscriptions(r)
-                        for subscription in subscriptions:
-                            success, themessages,errormessages = braintreestuff.cancel_subscription(r,id)
-                        for message in themessages:
-                            messages.info(request,message)
-                    except:
-                        pass
-                        
-                if cd['delete_user']:
-                    # delete workouts
-                    Workout.objects.filter(user=user.rower).delete()
-                    # delete planned sessions
-                    PlannedSession.objects.filter(manager=user).delete()
-                    
-                    user.delete()
-                    res = myqueue(queuehigh,
-                                  handle_sendemail_userdeleted,
-                                  name, email)
-
-                    url = '/logout/?next=/login'
-#                    url = reverse(auth_views.logout_then_login)
-                    return HttpResponseRedirect(url)
-        return render(request, "userprofile_delete.html", {
-            "user_form": user_form,
-            })
-    else:
-        raise PermissionDenied
-    
-
 
 # Shows analysis page
 @login_required()
+@permission_required('rower.is_coach',fn=get_user_by_userid,raise_exception=True)
 def analysis_view(request,userid=0):
     r = getrequestrower(request,userid=userid)
     return render(request,
@@ -200,9 +87,10 @@ def analysis_view(request,userid=0):
                       'rower':r,
                   }
                   )
-    
+
 # Shows laboratory page
 @login_required()
+@permission_required('rower.is_coach',fn=get_user_by_userid,raise_exception=True)
 def laboratory_view(request,userid=0):
     r = getrequestrower(request,userid=userid)
     return render(request,
@@ -212,9 +100,3 @@ def laboratory_view(request,userid=0):
                       'rower':r,
                   }
                   )
-    
-
-        
-
-
-

rowers/views/paymentviews.py

@@ -13,8 +13,8 @@ def paidplans_view(request):
     else:
         r = None
 
-    
-        
+
+
     return render(request,
                   'paidplans.html',
                   {'rower':r})
@@ -24,7 +24,7 @@ def billing_view(request):
     if not PAYMENT_PROCESSING_ON:
         url = reverse('promembership')
         return HttpResponseRedirect(url)
-        
+
     r = request.user.rower
 
     if r.paymentprocessor != 'braintree' and r.paymenttype == 'recurring':
@@ -42,7 +42,7 @@ def billing_view(request):
             for attr, value in cd.items():
                 setattr(r, attr, value)
             r.save()
-            
+
         if billingaddressform.is_valid():
             if planselectform.is_valid():
                 plan = planselectform.cleaned_data['plan']
@@ -58,7 +58,7 @@ def billing_view(request):
                               })
                 return HttpResponseRedirect(url)
 
-                    
+
     else:
         billingaddressform = RowerBillingAddressForm(instance=r)
         planselectform = PlanSelectForm(paymentprocessor='braintree')
@@ -69,13 +69,13 @@ def billing_view(request):
                    'billingaddressform':billingaddressform,
                    'planselectform':planselectform,
                    })
-        
+
 @login_required()
 def upgrade_view(request):
     if not PAYMENT_PROCESSING_ON:
         url = reverse('promembership')
         return HttpResponseRedirect(url)
-        
+
     r = request.user.rower
 
     if r.paymentprocessor != 'braintree' and r.paymenttype == 'recurring':
@@ -93,7 +93,7 @@ def upgrade_view(request):
             for attr, value in cd.items():
                 setattr(r, attr, value)
             r.save()
-            
+
         if planselectform.is_valid():
             plan = planselectform.cleaned_data['plan']
             if billingaddressform.is_valid():
@@ -102,7 +102,7 @@ def upgrade_view(request):
                                   'planid':plan.id
                               })
                 return HttpResponseRedirect(url)
-                    
+
     else:
         billingaddressform = RowerBillingAddressForm(instance=r)
         planselectform = PlanSelectForm(paymentprocessor='braintree',
@@ -114,13 +114,13 @@ def upgrade_view(request):
                    'billingaddressform':billingaddressform,
                    'planselectform':planselectform,
                    })
-        
+
 @login_required()
 def downgrade_view(request):
     if not PAYMENT_PROCESSING_ON:
         url = reverse('promembership')
         return HttpResponseRedirect(url)
-        
+
     r = request.user.rower
 
     if r.paymentprocessor != 'braintree' and r.paymenttype == 'recurring':
@@ -138,7 +138,7 @@ def downgrade_view(request):
             for attr, value in cd.items():
                 setattr(r, attr, value)
             r.save()
-            
+
         if planselectform.is_valid():
             plan = planselectform.cleaned_data['plan']
 
@@ -150,14 +150,14 @@ def downgrade_view(request):
                 return HttpResponseRedirect(url)
             else:
                 nextview = downgrade_confirm_view
-                
+
             if billingaddressform.is_valid():
                 url = reverse(nextview,
                               kwargs={
                                   'planid':plan.id
                               })
                 return HttpResponseRedirect(url)
-                    
+
     else:
         billingaddressform = RowerBillingAddressForm(instance=r)
         planselectform = PlanSelectForm(paymentprocessor='braintree',
@@ -169,17 +169,17 @@ def downgrade_view(request):
                    'billingaddressform':billingaddressform,
                    'planselectform':planselectform,
                    })
-        
+
 @login_required()
 def plan_stop_view(request):
     if not PAYMENT_PROCESSING_ON:
         url = reverse('promembership')
         return HttpResponseRedirect(url)
-        
+
     r = request.user.rower
 
     subscriptions = []
-    
+
     if r.paymentprocessor != 'braintree' and r.paymenttype == 'recurring':
         messages.error(request,'Automated payment processing is currently only available through BrainTree (by PayPal). You are currently on a recurring payment plan with PayPal. Contact the site administrator at support@rowsandall.com before you proceed')
 
@@ -189,7 +189,7 @@ def plan_stop_view(request):
         except ProcessorCustomerError:
             r.paymentprocessor = None
             r.save()
-            
+
 
 
     return render(request,
@@ -203,7 +203,7 @@ def plan_tobasic_view(request,id=0):
     if not PAYMENT_PROCESSING_ON:
         url = reverse('promembership')
         return HttpResponseRedirect(url)
-        
+
     r = request.user.rower
 
     if r.paidplan.paymentprocessor == 'braintree':
@@ -217,15 +217,15 @@ def plan_tobasic_view(request,id=0):
     url = reverse(plan_stop_view)
 
     return HttpResponseRedirect(url)
-        
-        
+
+
 
 @login_required()
 def upgrade_confirm_view(request,planid = 0):
     if not PAYMENT_PROCESSING_ON:
         url = reverse('promembership')
         return HttpResponseRedirect(url)
-        
+
     try:
         plan = PaidPlan.objects.get(id=planid)
     except PaidPlan.DoesNotExist:
@@ -253,7 +253,7 @@ def downgrade_confirm_view(request,planid = 0):
     if not PAYMENT_PROCESSING_ON:
         url = reverse('promembership')
         return HttpResponseRedirect(url)
-        
+
     try:
         plan = PaidPlan.objects.get(id=planid)
     except PaidPlan.DoesNotExist:
@@ -279,7 +279,7 @@ def payment_confirm_view(request,planid = 0):
     if not PAYMENT_PROCESSING_ON:
         url = reverse('promembership')
         return HttpResponseRedirect(url)
-        
+
     try:
         plan = PaidPlan.objects.get(id=planid)
     except PaidPlan.DoesNotExist:
@@ -350,13 +350,13 @@ def checkouts_view(request):
 
     url = reverse(paidplans_view)
     return HttpResponseRedirect(url)
-                          
+
 @login_required()
 def upgrade_checkouts_view(request):
     if not PAYMENT_PROCESSING_ON:
         url = reverse('promembership')
         return HttpResponseRedirect(url)
-        
+
 
     r = request.user.rower
 
@@ -402,7 +402,7 @@ def downgrade_checkouts_view(request):
     if not PAYMENT_PROCESSING_ON:
         url = reverse('promembership')
         return HttpResponseRedirect(url)
-        
+
 
     r = request.user.rower
 
@@ -450,7 +450,7 @@ def payment_completed_view(request):
 
     amount = request.GET.get('amount',0)
 
-        
+
     r = request.user.rower
 
     return render(request,
@@ -465,7 +465,7 @@ def downgrade_completed_view(request):
     if not PAYMENT_PROCESSING_ON:
         url = reverse('promembership')
         return HttpResponseRedirect(url)
-    
+
     r = request.user.rower
 
     return render(request,
@@ -480,7 +480,7 @@ def rower_register_view(request):
     nextpage = request.GET.get('next','/rowers/list-workouts/')
     if nextpage == '':
         nextpage = '/rowers/list-workouts/'
-    
+
     if request.method == 'POST':
         #form = RegistrationFormUniqueEmail(request.POST)
         form = RegistrationFormSex(request.POST)
@@ -517,7 +517,7 @@ def rower_register_view(request):
             timestr = strftime("%Y%m%d-%H%M%S")
             f2 = f[:-7]+timestr+'.csv.gz'
             copyfile(f,f2)
-                        
+
             response = dataprep.new_workout_from_file(therower,f2,
                                                       title='New User Sample Data',
                                                       notes='This is an example workout to get you started')
@@ -527,17 +527,17 @@ def rower_register_view(request):
                 w.startdatetime = timezone.now()
                 w.date = timezone.now().date()
                 w.save()
-            
+
             # Create and send email
             fullemail = first_name + " " + last_name + " " + "<" + email + ">"
             subject = "Thank you for registering on rowsandall.com"
             from_address = 'Sander Roosendaal <info@rowsandall.com>'
 
             d = {'first_name':theuser.first_name}
-            
+
             send_template_email(from_address,[fullemail],
                                 subject,'registeremail.html',d)
-            
+
 
             subject2 = "New User"
             message2 = "New user registered.\n"
@@ -550,7 +550,7 @@ def rower_register_view(request):
 
             theuser = authenticate(username=username,password=password)
             login(request,theuser)
-            
+
             return HttpResponseRedirect(nextpage)
         #        '/rowers/register/thankyou/')
 
@@ -572,7 +572,7 @@ def freecoach_register_view(request):
     nextpage = request.GET.get('next','/rowers/me/teams/')
     if nextpage == '':
         nextpage = '/rowers/me/teams/'
-    
+
     if request.method == 'POST':
         #form = RegistrationFormUniqueEmail(request.POST)
         form = RegistrationFormSex(request.POST)
@@ -605,17 +605,17 @@ def freecoach_register_view(request):
             # create default favorite charts
             add_defaultfavorites(therower)
 
-            
+
             # Create and send email
             fullemail = first_name + " " + last_name + " " + "<" + email + ">"
             subject = "Thank you for registering on rowsandall.com"
             from_address = 'Sander Roosendaal <info@rowsandall.com>'
 
             d = {'first_name':theuser.first_name}
-            
+
             send_template_email(from_address,[fullemail],
                                 subject,'coachregisteremail.html',d)
-            
+
 
             subject2 = "New Free Coach"
             message2 = "New Free Coach registered.\n"
@@ -628,7 +628,7 @@ def freecoach_register_view(request):
 
             theuser = authenticate(username=username,password=password)
             login(request,theuser)
-            
+
             return HttpResponseRedirect(nextpage)
 
         else:
@@ -647,6 +647,7 @@ def freecoach_register_view(request):
                        'next':nextpage,})
 
 @login_required()
+@permission_required('rower.is_staff',fn=get_user_by_userid,raise_exception=True)
 def transactions_view(request):
     if not request.user.is_staff:
         raise PermissionDenied("Not Allowed")
@@ -662,7 +663,7 @@ def transactions_view(request):
             response = HttpResponse(df.to_csv())
             response['Content-Disposition'] = 'attachment; filename="%s"' % filename
             response['Content-Type'] = 'application/octet-stream'
-            
+
             return response
 
     else:
@@ -673,4 +674,3 @@ def transactions_view(request):
                   {
                       'dateform':dateform
                   })
-    

rowers/views/planviews.py

@@ -5,27 +5,11 @@ from __future__ import unicode_literals
 
 from rowers.views.statements import *
 
-@login_required()
+@login_required
+@permission_required('plannedsession.view_session',fn=get_session_by_pk,raise_exception=True)
 def plannedsession_comment_view(request,id=0,userid=0):
     r = getrequestplanrower(request,userid=userid)
-
-    try:
-        ps = PlannedSession.objects.get(id=id)
-    except PlannedSession.DoesNotExist:
-        raise Http404("Planned Session does not exist")
-
-    m = ps.manager
-    mm = Rower.objects.get(user=m)
-
-    if ps.manager != request.user and ps.sessiontype not in ['race','indoorrace']:
-        if r.rowerplan == 'coach' and r not in ps.rower.all():
-            teams = Team.objects.filter(manager=request.user)
-            members = Rower.objects.filter(team__in=teams).distinct()
-            teamusers = [m.user for m in members]
-            if ps.manager not in teamusers:
-                raise PermissionDenied("You do not have access to this session")
-        elif r not in ps.rower.all():
-            raise PermissionDenied("You do not have access to this session")
+    ps = get_object_or_404(PlannedSession,pk=id)
 
     comments = PlannedSessionComment.objects.filter(plannedsession=ps).order_by("created")
 
@@ -171,7 +155,7 @@ def plannedsession_comment_view(request,id=0,userid=0):
             })
 
 # Cloning sessions
-@user_passes_test(hasplannedsessions,login_url="/rowers/paidplans/",
+@user_passes_test(can_plan,login_url="/rowers/paidplans/",
                   message="This functionality requires a Coach or Self-Coach plan",
                   redirect_field_name=None)
 def plannedsession_multiclone_view(
@@ -322,7 +306,7 @@ def plannedsession_multiclone_view(
                   )
 
 # Individual user creates training for himself
-@user_passes_test(hasplannedsessions,login_url="/rowers/paidplans/",
+@user_passes_test(can_plan,login_url="/rowers/paidplans/",
                   message="This functionality requires a Coach or Self-Coach plan",
                   redirect_field_name=None)
 def plannedsession_create_view(request,
@@ -332,9 +316,6 @@ def plannedsession_create_view(request,
 
     r = getrequestplanrower(request,userid=userid)
 
-
-
-
     startdate,enddate = get_dates_timeperiod(request,startdatestring=startdatestring,
                                              enddatestring=enddatestring)
 
@@ -477,7 +458,7 @@ def plannedsession_create_view(request,
                       'timeperiod':timeperiod,
                   })
 
-@user_passes_test(hasplannedsessions,login_url="/rowers/paidplans/",
+@user_passes_test(can_plan,login_url="/rowers/paidplans/",
                   message="This functionality requires a Coach or Self-Coach plan",
                   redirect_field_name=None)
 def plannedsession_multicreate_view(request,
@@ -613,7 +594,7 @@ def plannedsession_multicreate_view(request,
     return render(request,'plannedsession_multicreate.html',context)
 
 # Manager creates sessions for entire team
-@user_passes_test(hasplannedsessions,login_url="/rowers/paidplans/",
+@user_passes_test(can_plan,login_url="/rowers/paidplans/",
                   message="This functionality requires a Coach or Self-Coach plan",
                   redirect_field_name=None)
 def plannedsession_teamcreate_view(request,
@@ -788,21 +769,16 @@ def plannedsession_teamcreate_view(request,
                   })
 
 # Manager edits sessions for entire team
-@user_passes_test(hasplannedsessions,login_url="/rowers/paidplans/",
+@user_passes_test(can_plan,login_url="/rowers/paidplans/",
                   message="This functionality requires a Coach or Self-Coach plan",
                   redirect_field_name=None)
+@permission_required('plannedsession.change_session',fn=get_session_by_pk,raise_exception=True)
 def plannedsession_teamedit_view(request,
-                                 sessionid=0,userid=0):
+                                 id=0,userid=0):
 
     r = getrequestplanrower(request,userid=userid)
 
-
-    try:
-        ps = PlannedSession.objects.get(id=sessionid)
-    except PlannedSession.DoesNotExist:
-        raise Http404("This session doesn't exist")
-    if not ps.manager == request.user:
-        raise PermissionDenied("You are not the manager of this session")
+    ps = get_object_or_404(PlannedSession,pk=id)
 
     teams = Team.objects.filter(manager=request.user)
     teamchoices = [(team.id, team.name) for team in teams]
@@ -892,7 +868,7 @@ def plannedsession_teamedit_view(request,
 
             url = reverse(plannedsession_teamedit_view,
                           kwargs = {
-                              'sessionid':sessionid,
+                              'id':id,
                           })
 
             startdatestring = startdate.strftime('%Y-%m-%d')
@@ -1240,6 +1216,7 @@ def plannedsessions_print_view(request,userid=0):
 
 
 @login_required()
+@permission_required('rower.is_coach',fn=get_user_by_userid,raise_exception=True)
 def plannedsessions_manage_view(request,userid=0,
                                 initialsession=0):
 
@@ -1247,8 +1224,6 @@ def plannedsessions_manage_view(request,userid=0,
     if request.is_ajax():
         is_ajax = True
 
-
-
     r = getrequestrower(request,userid=userid)
 
     startdate,enddate = get_dates_timeperiod(request)
@@ -1404,7 +1379,8 @@ def plannedsessions_manage_view(request,userid=0,
 
 # Clone an existing planned session
 # need clarity on cloning behavior time shift
-@user_passes_test(hasplannedsessions,login_url="/rowers/paidplans/",
+@permission_required('plannedsession.change_session',fn=get_session_by_pk,raise_exception=True)
+@user_passes_test(can_plan,login_url="/rowers/paidplans/",
                   message="This functionality requires a Coach or Self-Coach plan",
                   redirect_field_name=None)
 def plannedsession_clone_view(request,id=0,userid=0):
@@ -1422,13 +1398,7 @@ def plannedsession_clone_view(request,id=0,userid=0):
     except IndexError:
         trainingplan = None
 
-    try:
-        ps = PlannedSession.objects.get(id=id)
-    except PlannedSession.DoesNotExist:
-        raise Http404("Planned Session does not exist")
-
-    if ps.manager != request.user:
-        raise PermissionDenied("You are not allowed to clone this planned session")
+    ps = get_object_or_404(PlannedSession,pk=id)
 
     rowers = ps.rower.all()
     teams = ps.team.all()
@@ -1472,7 +1442,8 @@ def plannedsession_clone_view(request,id=0,userid=0):
 
 # Clone an existing planned session
 # need clarity on cloning behavior time shift
-@user_passes_test(hasplannedsessions,login_url="/rowers/paidplans/",
+@permission_required('plannedsession.change_session',fn=get_session_by_pk,raise_exception=True)
+@user_passes_test(can_plan,login_url="/rowers/paidplans/",
                   message="This functionality requires a Coach or Self-Coach plan",
                   redirect_field_name=None)
 def plannedsession_teamclone_view(request,id=0):
@@ -1499,13 +1470,7 @@ def plannedsession_teamclone_view(request,id=0):
     except IndexError:
         trainingplan = None
 
-    try:
-        ps = PlannedSession.objects.get(id=id)
-    except PlannedSession.DoesNotExist:
-        raise Http404("Planned Session does not exist")
-
-    if ps.manager != request.user:
-        raise PermissionDenied("You are not allowed to clone this planned session")
+    ps = get_object_or_404(PlannedSession,pk=id)
 
 
     ps.pk = None
@@ -1524,7 +1489,7 @@ def plannedsession_teamclone_view(request,id=0):
 
     url = reverse(plannedsession_teamedit_view,
                   kwargs = {
-                      'sessionid':ps.id,
+                      'id':ps.id,
                       'userid':r.user.id,
                       }
     )
@@ -1536,7 +1501,8 @@ def plannedsession_teamclone_view(request,id=0):
     next = request.GET.get('next', url)
     return HttpResponseRedirect(next)
 
-@user_passes_test(hasplannedsessions, login_url="/rowers/paidplans/",
+@permission_required('plannedsession.change_session',fn=get_session_by_pk,raise_exception=True)
+@user_passes_test(can_plan, login_url="/rowers/paidplans/",
 message="This functionality requires a Coach or Self-Coach plan",
 redirect_field_name=None)
 def plannedsession_templateedit_view(request,id=0):
@@ -1629,7 +1595,8 @@ def plannedsession_templateedit_view(request,id=0):
                   })
 
 
-@user_passes_test(hasplannedsessions, login_url="/rowers/paidplans/",
+@permission_required('plannedsession.change_session',fn=get_session_by_pk,raise_exception=True)
+@user_passes_test(can_plan, login_url="/rowers/paidplans/",
                   message="This functionality requires a Coach or Self-Coach plan",
                   redirect_field_name=None)
 def plannedsession_totemplate_view(request,id=0):
@@ -1638,13 +1605,7 @@ def plannedsession_totemplate_view(request,id=0):
 
     startdate, enddate = get_dates_timeperiod(request)
 
-    try:
-        ps = PlannedSession.objects.get(id=id)
-    except PlannedSession.DoesNotExist:
-        raise Http404("Planned Session does not exist")
-
-    if ps.manager != request.user:
-        raise PermissionDenied("You can only store your own sessions as a template")
+    ps = get_object_or_404(PlannedSession,pk=id)
 
     ps.pk = None
     ps.id = None
@@ -1664,7 +1625,8 @@ def plannedsession_totemplate_view(request,id=0):
     return HttpResponseRedirect(next)
 
 # Edit an existing planned session
-@user_passes_test(hasplannedsessions,login_url="/rowers/paidplans/",
+@permission_required('plannedsession.change_session',fn=get_session_by_pk,raise_exception=True)
+@user_passes_test(can_plan,login_url="/rowers/paidplans/",
                   message="This functionality requires a Coach or Self-Coach plan",
                   redirect_field_name=None)
 def plannedsession_edit_view(request,id=0,userid=0):
@@ -1684,21 +1646,12 @@ def plannedsession_edit_view(request,id=0,userid=0):
     except IndexError:
         trainingplan = None
 
-    try:
-        ps = PlannedSession.objects.get(id=id)
-    except PlannedSession.DoesNotExist:
-        raise Http404("Planned Session does not exist")
-
-    if ps.manager != request.user:
-        raise PermissionDenied("You are not allowed to edit this planned session")
-
-    if ps.sessiontype in ['race','indoorrace']:
-        raise PermissionDenied("You are not allowed to edit this planned session because it is a race")
+    ps = get_object_or_404(PlannedSession,pk=id)
 
     if ps.team.all() or ps.rower.all().count()>1:
         url = reverse(plannedsession_teamedit_view,
                       kwargs={
-                          'sessionid':id,
+                          'id':id,
                           })
         return HttpResponseRedirect(url)
 
@@ -1794,21 +1747,16 @@ def plannedsession_edit_view(request,id=0,userid=0):
                   })
 
 
-@login_required()
+@permission_required('workout.change_workout',fn=get_workout_by_opaqueid,raise_exception=True)
 def plannedsession_detach_view(request,id=0,psid=0):
 
     r = getrequestrower(request)
 
-    try:
-        ps = PlannedSession.objects.get(id=psid)
-    except PlannedSession.DoesNotExist:
-        raise Http404("Planned Session does not exist")
+
+    ps = get_object_or_404(PlannedSession,pk=psid)
 
     w = get_workout(id)
 
-    if (checkworkoutuser(request.user,w)==False):
-        return HttpResponseForbidden("Permission Error")
-
     remove_workout_plannedsession(w,ps)
 
     url = reverse(plannedsession_view,kwargs={'id':psid})
@@ -1816,16 +1764,12 @@ def plannedsession_detach_view(request,id=0,psid=0):
     return HttpResponseRedirect(next)
 
 @login_required()
+@permission_required('plannedsession.view_session',fn=get_session_by_pk,raise_exception=True)
 def plannedsession_view(request,id=0,userid=0):
 
     r = getrequestplanrower(request,userid=userid)
 
-
-
-    try:
-        ps = PlannedSession.objects.get(id=id)
-    except PlannedSession.DoesNotExist:
-        raise Http404("Planned Session does not exist")
+    ps = get_object_or_404(PlannedSession,pk=id)
 
     if ps.sessiontype in ['race','indoorrace']:
         url = reverse('virtualevent_view',
@@ -1842,16 +1786,6 @@ def plannedsession_view(request,id=0,userid=0):
     m = ps.manager
     mm = Rower.objects.get(user=m)
 
-    if ps.manager != request.user:
-        if 'coach' in r.rowerplan and r not in ps.rower.all():
-            teams = Team.objects.filter(manager=request.user)
-            members = Rower.objects.filter(team__in=teams).distinct()
-            teamusers = [m.user for m in members]
-            if ps.manager not in teamusers:
-                raise PermissionDenied("You do not have access to this session")
-        elif r not in ps.rower.all():
-            raise PermissionDenied("You do not have access to this session")
-
     resultsdict = get_session_metrics(ps)
     resultsdict = pd.DataFrame(resultsdict).transpose().to_dict()
 
@@ -2055,24 +1989,23 @@ class PlannedSessionDelete(DeleteView):
             w.save()
 
         url = reverse(plannedsessions_view)
+        next = self.request.GET.get('next',url)
 
-        return url
+        return next
 
     def get_object(self, *args, **kwargs):
         obj = super(PlannedSessionDelete, self).get_object(*args, **kwargs)
-        m = Rower.objects.get(user=obj.manager)
-        if not checkaccessuser(self.request.user,m):
+        if not can_delete_session(self.request.user,obj):
             raise PermissionDenied('You are not allowed to delete this planned session')
 
         return obj
 
 
-@user_passes_test(hasplannedsessions,login_url="/rowers/paidplans",
+@user_passes_test(can_plan,login_url="/rowers/paidplans",
                   message="This functionality requires a Coach or Self-Coach plan",
                   redirect_field_name=None)
-def rower_create_trainingplan(request,userid=0):
-
-    therower = getrequestrower(request,userid=userid)
+def rower_create_trainingplan(request,id=0):
+    therower = getrequestrower(request,userid=id)
     theuser = therower.user
     themanager = getrower(request.user)
 
@@ -2138,7 +2071,8 @@ def rower_create_trainingplan(request,userid=0):
             p.save()
 
             for athlete in athletes:
-                p.rowers.add(athlete)
+                if can_plan_user(request.user,athlete):
+                    p.rowers.add(athlete)
 
 
     targets = TrainingTarget.objects.filter(
@@ -2173,12 +2107,12 @@ def rower_create_trainingplan(request,userid=0):
     breadcrumbs = [
         {
             'url':reverse(plannedsessions_view,
-                          kwargs={'userid':userid}),
+                          kwargs={'userid':id}),
             'name': 'Plan'
         },
         {
             'url':reverse(rower_create_trainingplan,
-                          kwargs={'userid':userid}),
+                          kwargs={'id':id}),
             'name': 'Manage Plans and Targets'
             }
         ]
@@ -2196,40 +2130,27 @@ def rower_create_trainingplan(request,userid=0):
                       'old_targets':old_targets,
                       })
 
-@user_passes_test(hasplannedsessions,login_url="/rowers/paidplans",
+@user_passes_test(can_plan,login_url="/rowers/paidplans",
                   message="This functionality requires a Coach or Self-Coach plan",
                   redirect_field_name=None)
+@permission_required('target.delete_target',fn=get_target_by_pk,raise_exception=True)
 def rower_delete_trainingtarget(request,id=0):
-    try:
-        target = TrainingTarget.objects.get(id=id)
-    except TrainingPlan.DoesNotExist:
-        raise Http404("Training Plan Does Not Exist")
 
-    if checkaccessuser(request.user,target.manager):
-        target.delete()
-        messages.info(request,"We have deleted the training target")
-    else:
-        raise PermissionDenied("Access denied")
+    target = get_object_or_404(TrainingTarget,pk=id)
+    target.delete()
 
     url = reverse(rower_create_trainingplan)
 
     return HttpResponseRedirect(url)
 
 
-@user_passes_test(hasplannedsessions,login_url="/rowers/paidplans",
+@user_passes_test(can_plan,login_url="/rowers/paidplans",
                   message="This functionality requires a Coach or Self-Coach plan",
                   redirect_field_name=None)
+@permission_required('target.delete_plan',fn=get_plan_by_pk,raise_exception=True)
 def rower_delete_trainingplan(request,id=0):
-    try:
-        plan = TrainingPlan.objects.get(id=id)
-    except TrainingPlan.DoesNotExist:
-        raise Http404("Training Plan Does Not Exist")
-
-    if checkaccessuser(request.user,plan.manager):
-        plan.delete()
-        messages.info(request,"We have deleted the training plan")
-    else:
-        raise PermissionDenied("Access denied")
+    plan = get_object_or_404(TrainingPlan,pk=id)
+    plan.delete()
 
     url = reverse(rower_create_trainingplan)
 
@@ -2242,7 +2163,7 @@ class TrainingPlanDelete(DeleteView):
 
     def get_object(self, *args, **kwargs):
         obj = super(TrainingPlanDelete, self).get_object(*args, **kwargs)
-        if not checkaccessuser(self.request.user,obj.manager):
+        if not can_delete_plan(self.request.user,obj):
             raise PermissionDenied('You are not allowed to delete this training plan')
 
         return obj
@@ -2308,7 +2229,7 @@ class MicroCycleDelete(DeleteView):
 
     def get_object(self, *args, **kwargs):
         obj = super(MicroCycleDelete, self).get_object(*args, **kwargs)
-        if not checkaccessuser(self.request.user,obj.plan.plan.plan.manager):
+        if not can_delete_cycle(self.request.user,obj):
             raise PermissionDenied('You are not allowed to delete this training plan cycle')
         return obj
 
@@ -2370,7 +2291,7 @@ class MesoCycleDelete(DeleteView):
     def get_object(self, *args, **kwargs):
         obj = super(MesoCycleDelete, self).get_object(*args, **kwargs)
 
-        if not checkaccessuser(self.request.user,obj.plan.plan.manager):
+        if not can_delete_cycle(self.request.user,obj):
             raise PermissionDenied('You are not allowed to delete this training plan cycle')
 
         return obj
@@ -2424,13 +2345,13 @@ class MacroCycleDelete(DeleteView):
 
     def get_object(self, *args, **kwargs):
         obj = super(MacroCycleDelete, self).get_object(*args, **kwargs)
-        if not checkaccessuser(self.request.user,obj.plan.manager):
+        if not can_delete_cycle(self.request.user,obj):
             raise PermissionDenied('You are not allowed to delete this training plan cycle')
 
         return obj
 
 
-@user_passes_test(hasplannedsessions,login_url="/rowers/paidplans",
+@user_passes_test(can_plan,login_url="/rowers/paidplans",
                   message="This functionality requires a Coach or Self-Coach plan",
                   redirect_field_name=None)
 def rower_trainingplan_execution_view(request,
@@ -2447,7 +2368,7 @@ def rower_trainingplan_execution_view(request,
             plan = TrainingPlan.objects.get(id=id)
         except TrainingPlan.DoesNotExist:
             raise Http404("Training Plan Does Not Exist")
-        if not checkaccessuser(request.user,plan.manager):
+        if not is_coach_user(request.user,plan.manager.user):
             if request.user.rower not in plan.rowers.all():
                 raise PermissionDenied("Access denied")
 
@@ -2520,9 +2441,11 @@ def rower_trainingplan_execution_view(request,
                   )
 
 
-@user_passes_test(hasplannedsessions,login_url="/rowers/paidplans",
-                  message="This functionality requires a Coach or Self-Coach plan",
-                  redirect_field_name=None)
+#@user_passes_test(can_plan,login_url="/rowers/paidplans",
+#                  message="This functionality requires a Coach or Self-Coach plan",
+#                  redirect_field_name=None)
+@login_required()
+@permission_required('plan.view_plan',fn=get_plan_by_pk,raise_exception=True)
 def rower_trainingplan_view(request,
                             id=0,
                             userid=0,
@@ -2533,18 +2456,9 @@ def rower_trainingplan_view(request,
 
     startdate,enddate = get_dates_timeperiod(request)
 
-
-    try:
-        plan = TrainingPlan.objects.get(id=id)
-    except TrainingPlan.DoesNotExist:
-        raise Http404("Training Plan Does Not Exist")
-
+    plan = get_object_or_404(TrainingPlan,pk=id)
     r = getrequestrower(request,userid=userid)
 
-    if not checkaccessuser(request.user,plan.manager):
-        if request.user.rower not in plan.rowers.all():
-            raise PermissionDenied("Access denied")
-
     createmacrofillers(plan)
     macrocycles = TrainingMacroCycle.objects.filter(
         plan=plan,
@@ -2667,10 +2581,7 @@ class TrainingMacroCycleUpdate(UpdateView):
 
     def get_object(self, *args, **kwargs):
         obj = super(TrainingMacroCycleUpdate, self).get_object(*args, **kwargs)
-        if obj.plan.manager is not None and self.request.user.rower != obj.plan.manager:
-            raise PermissionDenied('You are not allowed to edit this training plan cycle')
-
-        if not checkaccessuser(self.request.user,obj.plan.manager):
+        if not can_change_cycle(self.request.user,obj):
             raise PermissionDenied('You are not allowed to edit this training plan cycle')
         else:
             obj.type = 'userdefined'
@@ -2741,7 +2652,7 @@ class TrainingMesoCycleUpdate(UpdateView):
 
     def get_object(self, *args, **kwargs):
         obj = super(TrainingMesoCycleUpdate, self).get_object(*args, **kwargs)
-        if obj.plan.plan.manager is not None and self.request.user.rower != obj.plan.plan.manager:
+        if not can_change_cycle(self.request.user,obj):
             raise PermissionDenied('You are not allowed to edit this training plan cycle')
 
         else:
@@ -2819,7 +2730,7 @@ class TrainingMicroCycleUpdate(UpdateView):
 
     def get_object(self, *args, **kwargs):
         obj = super(TrainingMicroCycleUpdate, self).get_object(*args, **kwargs)
-        if obj.plan.plan.plan.manager is not None and self.request.user.rower != obj.plan.plan.plan.manager:
+        if not can_change_cycle(self.request.user,obj):
             raise PermissionDenied('You are not allowed to edit this training plan cycle')
 
 
@@ -2884,10 +2795,8 @@ class TrainingPlanUpdate(UpdateView):
 
     def get_object(self, *args, **kwargs):
         obj = super(TrainingPlanUpdate, self).get_object(*args, **kwargs)
-        if obj.manager is not None and self.request.user.rower != obj.manager:
+        if not can_change_plan(self.request.user,obj):
             raise PermissionDenied('You are not allowed to edit this training plan cycle')
-        if obj.manager.rowerplan not in ['coach','freecoach','plan']:
-            raise PermissionDenied('You are not allowed to edit this training plan')
 
         return obj
 
@@ -2936,24 +2845,19 @@ class TrainingTargetUpdate(UpdateView):
 
     def get_object(self, *args, **kwargs):
         obj = super(TrainingTargetUpdate, self).get_object(*args, **kwargs)
-        if obj.manager is not None and self.request.user.rower != obj.manager:
+        if not can_change_target(self.request.user,obj):
             raise PermissionDenied('You are not allowed to edit this training plan cycle')
 
         return obj
 
 from rowers.utils import allsundays
 
-@user_passes_test(hasplannedsessions,login_url="/rowers/paidplans",
+@user_passes_test(can_plan,login_url="/rowers/paidplans",
                   message="This functionality requires a Coach or Self-Coach plan",
                   redirect_field_name=None)
+@permission_required('cycle.change_cycle',fn=get_meso_by_pk,raise_exception=True)
 def planmesocyclebyweek(request,id=0,userid=0):
-    try:
-        cycle = TrainingMesoCycle.objects.get(id=id)
-    except TrainingMesoCycle.DoesNotExist:
-        raise Http404("Training Cycle does not exist")
-
-    if not checkaccessuser(request.user,cycle.plan.plan.manager):
-        raise PermissionDenied("You are not allowed to do this")
+    cycle = get_object_or_404(TrainingMesoCycle,pk=id)
 
     micros = TrainingMicroCycle.objects.filter(plan=cycle)
     for m in micros:
@@ -2998,17 +2902,12 @@ def planmesocyclebyweek(request,id=0,userid=0):
 
 from rowers.utils import allmonths
 
-@user_passes_test(hasplannedsessions,login_url="/rowers/paidplans",
+@user_passes_test(can_plan,login_url="/rowers/paidplans",
                   message="This functionality requires a Coach or Self-Coach plan",
                   redirect_field_name=None)
+@permission_required('cycle.change_cycle',fn=get_macro_by_pk,raise_exception=True)
 def planmacrocyclebymonth(request,id=0,userid=0):
-    try:
-        cycle = TrainingMacroCycle.objects.get(id=id)
-    except TrainingMacroCycle.DoesNotExist:
-        raise Http404("Training Cycle does not exist")
-
-    if not checkaccessuser(request.user,cycle.plan.manager):
-        raise PermissionDenied("You are not allowed to do this")
+    cycle = get_object_or_404(TrainingMacroCycle,pk=id)
 
     mesos = TrainingMesoCycle.objects.filter(plan=cycle)
     for m in mesos:

rowers/views/racesviews.py

@@ -7,7 +7,6 @@ from rowers.views.statements import *
 
 
 # List Courses
-@login_required()
 def courses_view(request):
     r = getrower(request.user)
 
@@ -45,7 +44,7 @@ def course_map_view(request,id=0):
         return Http404("Course doesn't exist")
 
     script,div = course_map(course)
-    
+
     breadcrumbs = [
         {
             'url': reverse('virtualevents_view'),
@@ -64,10 +63,10 @@ def course_map_view(request,id=0):
             'name': 'Map'
         }
     ]
-    
+
     r = getrower(request.user)
-    
-    
+
+
     return render(request,
                   'coursemap.html',
                   {
@@ -76,21 +75,16 @@ def course_map_view(request,id=0):
                       'mapscript':script,
                       'active':'nav-racing',
                       'rower':r,
-                      'breadcrumbs':breadcrumbs,                          
+                      'breadcrumbs':breadcrumbs,
                   })
 
-    
+
 @login_required()
+@permission_required('course.change_course',fn=get_course_by_pk,raise_exception=True)
 def course_replace_view(request,id=0):
-    try:
-        course = GeoCourse.objects.get(id=id)
-    except GeoCourse.DoesNotExist:
-        return Http404("Course doesn't exist")
+    course = get_object_or_404(GeoCourse,pk=id)
 
     r = getrower(request.user)
-    
-    if course.manager != r:
-        raise PermissionDenied("Access denied")
 
     thecourses = GeoCourse.objects.filter(manager=r).exclude(id=id)
 
@@ -141,18 +135,13 @@ def course_replace_view(request,id=0):
                    'mapdiv':div,
                    'mapscript':script,
                    'form':form})
-    
+
 @login_required()
+@permission_required('course.delete_course',fn=get_course_by_pk,raise_exception=True)
 def course_delete_view(request,id=0):
-    try:
-        course = GeoCourse.objects.get(id=id)
-    except GeoCourse.DoesNotExist:
-        return Http404("Course doesn't exist")
+    course = get_object_or_404(GeoCourse,pk=id)
 
     r = getrower(request.user)
-    
-    if course.manager != r:
-        raise PermissionDenied("Access denied")
 
     ps = PlannedSession.objects.filter(course=course)
     nosessions = len(ps) == 0
@@ -163,22 +152,17 @@ def course_delete_view(request,id=0):
     url = reverse(courses_view)
 
     return HttpResponseRedirect(url)
-    
+
 @login_required()
+@permission_required('course.change_course',fn=get_course_by_pk,raise_exception=True)
 def course_edit_view(request,id=0):
-    try:
-        course = GeoCourse.objects.get(id=id)
-    except GeoCourse.DoesNotExist:
-        return Http404("Course doesn't exist")
+    course = get_object_or_404(GeoCourse,pk=id)
 
     r = getrower(request.user)
-    
-    if course.manager != r:
-        raise PermissionDenied("Access denied")
 
     ps = PlannedSession.objects.filter(course=course)
     nosessions = len(ps) == 0
-    
+
     script,div = course_map(course)
 
     if request.method == 'POST':
@@ -187,7 +171,7 @@ def course_edit_view(request,id=0):
             name = form.cleaned_data['name']
             country = form.cleaned_data['country']
             notes = form.cleaned_data['notes']
-            
+
             course.name = name
             course.country = country
             course.notes = notes
@@ -213,7 +197,7 @@ def course_edit_view(request,id=0):
             'name': 'Edit'
             }
         ]
-    
+
     return render(request, 'course_edit_view.html',
                   {
                       'course':course,
@@ -235,9 +219,9 @@ def course_view(request,id=0):
         return Http404("Course doesn't exist")
 
     r = getrower(request.user)
-    
+
     script,div = course_map(course)
-    
+
     breadcrumbs = [
         {
             'url': reverse('virtualevents_view'),
@@ -266,11 +250,10 @@ def course_view(request,id=0):
                   )
 
 @login_required()
+@permission_required('racelogo.delete_logo',fn=get_logo_by_pk,raise_exception=True)
 def logo_delete_view(request,id=0):
-    try:
-        logo = RaceLogo.objects.get(id=id)
-    except RaceLogo.DoesNotExist:
-        raise Http404("Logo doesn't exist")
+    logo = get_object_or_404(RaceLogo,pk=id)
+
 
     if logo.user == request.user:
         logo.delete()
@@ -281,28 +264,18 @@ def logo_delete_view(request,id=0):
     return HttpResponseRedirect(url)
 
 @login_required()
+@permission_required('virtualevent.change_race',fn=get_virtualevent_by_pk,raise_exception=True)
 def virtualevent_setlogo_view(request,id=0,logoid=0):
-    try:
-        race = VirtualRace.objects.get(id=id)
-    except VirtualRace.DoesNotExist:
-        raise Http404("Race doesn't exist")
+    race = get_object_or_404(VirtualRace,pk=id)
+    logo = get_object_or_404(RaceLogo,pk=logoid)
 
-    try:
-        logo = RaceLogo.objects.get(id=logoid)
-    except RaceLogo.DoesNotExist:
-        raise Http404("Logo doesn't exist")
+    otherlogos = race.logos.all()
+    for otherlogo in otherlogos:
+        otherlogo.race.remove(race)
 
-    if logo.user == request.user and race.manager == request.user:
-        otherlogos = race.logos.all()
-        for otherlogo in otherlogos:
-            otherlogo.race.remove(race)
 
-        
-        logo.race.add(race)
-        logo.save()
-    else:
-        message = "You do not own this race or this image"
-        messages.error(request,message)
+    logo.race.add(race)
+    logo.save()
 
     url = reverse('virtualevent_view',
                   kwargs={'id':id})
@@ -318,10 +291,7 @@ def virtualevent_uploadimage_view(request,id=0):
 
     r = getrower(request.user)
 
-    try:
-        race = VirtualRace.objects.get(id=id)
-    except VirtualRace.DoesNotExist:
-        raise Http404("Race doesn't exist")
+    race = get_object_or_404(VirtualRace,pk=id)
 
     logos = RaceLogo.objects.filter(user=request.user).order_by("-creationdatetime")
 
@@ -348,7 +318,7 @@ def virtualevent_uploadimage_view(request,id=0):
                           kwargs={'id':id})
 
             return HttpResponseRedirect(url)
-            
+
         form = ImageForm(request.POST, request.FILES)
         if form.is_valid():
             f = form.cleaned_data['file']
@@ -399,14 +369,14 @@ def virtualevent_uploadimage_view(request,id=0):
                 else:
                     return HttpResponseRedirect(url)
     else:
-        
+
         form = ImageForm()
 
 
     if is_ajax:
         return {'result':0}
 
-    
+
     return render(request,'logo_form.html',
                   {'form':form,
                    'rower':r,
@@ -425,7 +395,7 @@ def course_upload_view(request):
         is_ajax = True
 
     r = getrower(request.user)
-    
+
     if request.method == 'POST':
         form = CourseForm(request.POST,request.FILES)
 
@@ -435,7 +405,7 @@ def course_upload_view(request):
             notes = form.cleaned_data['notes']
             if f is not None:
                 filename,path_and_filename = handle_uploaded_file(f)
-            
+
                 cs = courses.kmltocourse(path_and_filename)
 
 
@@ -443,11 +413,11 @@ def course_upload_view(request):
                     cname = name+' - '+course['name']
                     cnotes = notes+'\n\n'+course['description']
                     polygons = course['polygons']
-                    
+
                     course = courses.createcourse(r,cname,polygons,notes=cnotes)
-                    
+
                 os.remove(path_and_filename)
-                
+
                 url = reverse(courses_view)
                 if is_ajax:
                     return JSONResponse({'result':1,'url':url})
@@ -492,7 +462,7 @@ def virtualevents_view(request):
         evaluation_closure__gte=timezone.now()-datetime.timedelta(days=3),
     )
 
-                
+
     races = (races1 | races2).order_by("startdate","start_time")
 
     if not request.user.is_anonymous:
@@ -524,7 +494,7 @@ def virtualevents_view(request):
                     country__in=countries
                     )
 
-                
+
                 races = (races1 | races2).order_by("startdate","start_time")
 
 
@@ -550,7 +520,7 @@ def virtualevents_view(request):
                     country__in=countries
                     ).order_by("startdate","start_time")
     else:
-    
+
         form = VirtualRaceSelectForm()
 
     if is_ajax:
@@ -558,7 +528,7 @@ def virtualevents_view(request):
                       { 'races':races,
                         'rower':r,
                         })
-        
+
     breadcrumbs = [
         {
             'url':reverse('virtualevents_view'),
@@ -576,18 +546,13 @@ def virtualevents_view(request):
     )
 
 @login_required()
-def virtualevent_disqualify_view(request,raceid=0,recordid=0):
+@permission_required('virtualevent.change_race',fn=get_virtualevent_by_pk,raise_exception=True)
+def virtualevent_disqualify_view(request,id=0,recordid=0):
 
     r = getrower(request.user)
+    race = get_object_or_404(VirtualRace,pk=id)
+
 
-    try:
-        race = VirtualRace.objects.get(id=raceid)
-    except VirtualRace.DoesNotExist:
-        raise Http404("Virtual Race does not exist")
-        
-    if r.user != race.manager:
-        raise PermissionDenied("Access denied")
-    
     if race.sessiontype == 'race':
         recordobj = VirtualRaceResult
     else:
@@ -603,7 +568,7 @@ def virtualevent_disqualify_view(request,raceid=0,recordid=0):
     if timezone.now() > race.evaluation_closure+datetime.timedelta(hours=1):
         messages.error(request,"The evaluation is already closed and the results are official")
         url = reverse('virtualevent_view',kwargs={'id':raceid})
-        
+
         return HttpResponseRedirect(url)
 
     if request.method == 'POST':
@@ -619,16 +584,16 @@ def virtualevent_disqualify_view(request,raceid=0,recordid=0):
             job = myqueue(queue,handle_send_disqualification_email,
                           r.user.email, name,
                           disqualifier,message,race.name)
-    
+
             messages.info(request,"We have invalidated the result for: "+str(record))
-            
+
             record.coursecompleted = False
             record.save()
 
             url = reverse('virtualevent_view',kwargs={'id':raceid})
 
             return HttpResponseRedirect(url)
-            
+
     else:
         form = DisqualificationForm(request.POST)
 
@@ -705,7 +670,7 @@ def virtualevent_disqualify_view(request,raceid=0,recordid=0):
 
         if race_can_edit(r,race):
             buttons += ['editbutton']
-        
+
     return render(request,"disqualification_view.html",
                   {'workout':workout,
                    'active':'nav-racing',
@@ -723,13 +688,13 @@ def virtualevent_disqualify_view(request,raceid=0,recordid=0):
 def virtualevent_view(request,id=0):
 
     results = []
-    
+
     if not request.user.is_anonymous:
         r = getrower(request.user)
     else:
         r = None
 
-        
+
     try:
         race = VirtualRace.objects.get(id=id)
     except VirtualRace.DoesNotExist:
@@ -744,8 +709,8 @@ def virtualevent_view(request,id=0):
         resultobj = IndoorVirtualRaceResult
 
     records = resultobj.objects.filter(race=race)
-        
-               
+
+
     buttons = []
 
     # to-do - add DNS
@@ -755,7 +720,7 @@ def virtualevent_view(request,id=0):
             race=race,
             workoutid__isnull=True,
         )
-    
+
 
     if not request.user.is_anonymous:
         if race_can_register(r,race):
@@ -790,14 +755,14 @@ def virtualevent_view(request,id=0):
             except KeyError:
                 boattype = mytypes.waterboattype
 
-            try:                
+            try:
                 boatclass = cd['boatclass']
             except KeyError:
                 if race.sessiontype == 'race':
                     boatclass = [t for t in mytypes.otwtypes]
                 else:
                     boatclass = [t for t in mytypes.otetypes]
-                    
+
             age_min = cd['age_min']
             age_max = cd['age_max']
 
@@ -834,8 +799,8 @@ def virtualevent_view(request,id=0):
                     age__gte=age_min,
                     age__lte=age_max
                 ).order_by("duration","-distance")
-                
-                
+
+
             # to-do - add DNS
             dns = []
             if timezone.now() > race.evaluation_closure:
@@ -860,9 +825,9 @@ def virtualevent_view(request,id=0):
             form = RaceResultFilterForm(records=records)
         else:
             form = None
-            
 
-        
+
+
     breadcrumbs = [
         {
             'url':reverse('virtualevents_view'),
@@ -875,7 +840,7 @@ def virtualevent_view(request,id=0):
             'name': race.name
             }
         ]
-            
+
     racelogos = race.logos.all()
 
     if racelogos:
@@ -885,7 +850,7 @@ def virtualevent_view(request,id=0):
 
     comments = PlannedSessionComment.objects.filter(plannedsession=race).order_by("created")
 
-        
+
     return render(request,'virtualevent.html',
                   {
                       'coursescript':script,
@@ -906,13 +871,13 @@ def virtualevent_view(request,id=0):
 def virtualevent_ranking_view(request,id=0):
 
     results = []
-    
+
     if not request.user.is_anonymous:
         r = getrower(request.user)
     else:
         r = None
 
-        
+
     try:
         race = VirtualRace.objects.get(id=id)
     except VirtualRace.DoesNotExist:
@@ -927,8 +892,8 @@ def virtualevent_ranking_view(request,id=0):
         resultobj = IndoorVirtualRaceResult
 
     records = resultobj.objects.filter(race=race)
-        
-               
+
+
     buttons = []
 
     # to-do - add DNS
@@ -938,7 +903,7 @@ def virtualevent_ranking_view(request,id=0):
             race=race,
             workoutid__isnull=True,
         )
-    
+
 
     if not request.user.is_anonymous:
         if race_can_register(r,race):
@@ -973,14 +938,14 @@ def virtualevent_ranking_view(request,id=0):
             except KeyError:
                 boattype = mytypes.waterboattype
 
-            try:                
+            try:
                 boatclass = cd['boatclass']
             except KeyError:
                 if race.sessiontype == 'race':
                     boatclass = [t for t in mytypes.otwtypes]
                 else:
                     boatclass = [t for t in mytypes.otetypes]
-                    
+
             age_min = cd['age_min']
             age_max = cd['age_max']
 
@@ -1017,8 +982,8 @@ def virtualevent_ranking_view(request,id=0):
                     age__gte=age_min,
                     age__lte=age_max
                 ).order_by("duration","-distance")
-                
-                
+
+
             # to-do - add DNS
             dns = []
             if timezone.now() > race.evaluation_closure:
@@ -1043,9 +1008,9 @@ def virtualevent_ranking_view(request,id=0):
             form = RaceResultFilterForm(records=records)
         else:
             form = None
-            
 
-        
+
+
     breadcrumbs = [
         {
             'url':reverse('virtualevents_view'),
@@ -1058,7 +1023,7 @@ def virtualevent_ranking_view(request,id=0):
             'name': race.name
             }
         ]
-            
+
     racelogos = race.logos.all()
 
     if racelogos:
@@ -1132,7 +1097,7 @@ def virtualevent_addboat_view(request,id=0):
     boattypes = [record.boattype for record in records]
     boatclasses = [record.boatclass for record in records]
     allowedboats = tuple([ type for type in mytypes.boattypes if type[0] not in boattypes] )
-    
+
 
     # we're still here
     if request.method == 'POST':
@@ -1151,14 +1116,14 @@ def virtualevent_addboat_view(request,id=0):
             sex = r.sex
             if mix:
                 sex = 'mixed'
-            
+
             if boattype == '1x' and r.birthdate:
                 age = calculate_age(r.birthdate)
                 sex = r.sex
 
             if sex == 'not specified':
                 sex = 'male'
-            
+
             if boattype in boattypes and boatclass in boatclasses:
                 # check if different sexes
                 therecords = records.filter(
@@ -1167,7 +1132,7 @@ def virtualevent_addboat_view(request,id=0):
 
                 thesexes = [record.sex for record in therecords]
                 if sex in thesexes:
-                
+
                     messages.error(
                         request,
                         "You have already registered in that boat class/type"
@@ -1199,11 +1164,11 @@ def virtualevent_addboat_view(request,id=0):
                 )
 
             record.save()
-                
+
             add_rower_race(r,race)
 
-            
-            
+
+
             messages.info(
                 request,
                 "You have successfully registered for this race. Good luck!"
@@ -1215,14 +1180,14 @@ def virtualevent_addboat_view(request,id=0):
                           })
 
             return HttpResponseRedirect(url)
-        
+
     else:
         initial = {
             'age': calculate_age(r.birthdate),
             'weightcategory': r.weightcategory,
             'adaptiveclass': r.adaptiveclass,
             }
-        
+
         form = VirtualRaceResultForm(initial=initial)
 
     breadcrumbs = [
@@ -1243,8 +1208,8 @@ def virtualevent_addboat_view(request,id=0):
             'name': 'Add Discipline'
             }
         ]
-            
-    
+
+
     buttons = []
 
     if not request.user.is_anonymous:
@@ -1311,7 +1276,7 @@ def virtualevent_register_view(request,id=0):
             sex = r.sex
             if mix:
                 sex = 'mixed'
-            
+
             if boattype == '1x' and r.birthdate:
                 age = calculate_age(r.birthdate)
                 sex = r.sex
@@ -1338,7 +1303,7 @@ def virtualevent_register_view(request,id=0):
                 )
 
             record.save()
-                
+
             add_rower_race(r,race)
 
             otherrecords = IndoorVirtualRaceResult.objects.filter(
@@ -1357,8 +1322,8 @@ def virtualevent_register_view(request,id=0):
                         race.name,
                         race.id
                     )
-            
-            
+
+
             messages.info(
                 request,
                 "You have successfully registered for this race. Good luck!"
@@ -1370,14 +1335,14 @@ def virtualevent_register_view(request,id=0):
                           })
 
             return HttpResponseRedirect(url)
-        
+
     else:
         initial = {
             'age': calculate_age(r.birthdate),
             'weightcategory': r.weightcategory,
             'adaptiveclass': r.adaptiveclass,
             }
-        
+
         form = VirtualRaceResultForm(initial=initial)
 
     breadcrumbs = [
@@ -1419,7 +1384,7 @@ def virtualevent_register_view(request,id=0):
 
         if race_can_edit(r,race):
             buttons += ['editbutton']
-    
+
     return render(request,'virtualeventregister.html',
                   {
                       'form':form,
@@ -1440,7 +1405,7 @@ def virtualevent_toggle_email_view(request,id=0):
         newsetting = False
     else:
         newsetting = True
-        
+
     for record in records:
         record.emailnotifications = newsetting
         record.save()
@@ -1454,7 +1419,7 @@ def virtualevent_toggle_email_view(request,id=0):
 def indoorvirtualevent_toggle_email_view(request,id=0):
     r = getrower(request.user)
     race = VirtualRace.objects.get(id=id)
-    
+
     records = IndoorVirtualRaceResult.objects.filter(userid=r.id,
                                                      race=race)
 
@@ -1462,7 +1427,7 @@ def indoorvirtualevent_toggle_email_view(request,id=0):
         newsetting = False
     else:
         newsetting = True
-        
+
     for record in records:
         record.emailnotifications = newsetting
         record.save()
@@ -1503,7 +1468,7 @@ def indoorvirtualevent_register_view(request,id=0):
             boatclass = cd['boatclass']
 
             sex = r.sex
-            
+
             if r.birthdate:
                 age = calculate_age(r.birthdate)
                 sex = r.sex
@@ -1529,7 +1494,7 @@ def indoorvirtualevent_register_view(request,id=0):
                 )
 
             record.save()
-                
+
             add_rower_race(r,race)
 
             otherrecords = IndoorVirtualRaceResult.objects.filter(
@@ -1548,8 +1513,8 @@ def indoorvirtualevent_register_view(request,id=0):
                         race.name,
                         race.id
                     )
-            
-            
+
+
             messages.info(
                 request,
                 "You have successfully registered for this race. Good luck!"
@@ -1561,14 +1526,14 @@ def indoorvirtualevent_register_view(request,id=0):
                           })
 
             return HttpResponseRedirect(url)
-        
+
     else:
         initial = {
             'age': calculate_age(r.birthdate),
             'weightcategory': r.weightcategory,
             'adaptiveclass': r.adaptiveclass,
             }
-        
+
         form = IndoorVirtualRaceResultForm(initial=initial)
 
     breadcrumbs = [
@@ -1624,7 +1589,7 @@ def indoorvirtualevent_register_view(request,id=0):
 @login_required()
 def indoorvirtualevent_create_view(request):
     r = getrower(request.user)
-        
+
     if request.method == 'POST':
         racecreateform = IndoorVirtualRaceForm(request.POST)
         if racecreateform.is_valid():
@@ -1650,7 +1615,7 @@ def indoorvirtualevent_create_view(request):
             startdatetime = datetime.datetime.combine(startdate,start_time)
             enddatetime = datetime.datetime.combine(enddate,end_time)
 
-            
+
             startdatetime = pytz.timezone(timezone_str).localize(
                 startdatetime
             )
@@ -1681,7 +1646,7 @@ def indoorvirtualevent_create_view(request):
                 sessionmode = 'time'
             else:
                 sessionmode = 'distance'
-                
+
             vs = VirtualRace(
                 name=name,
                 startdate=startdate,
@@ -1719,7 +1684,7 @@ def indoorvirtualevent_create_view(request):
                 ),
                 dotweet = dotweet
             )
-            
+
             sa.save()
 
             url = reverse('virtualevents_view')
@@ -1728,7 +1693,7 @@ def indoorvirtualevent_create_view(request):
 
         racecreateform = IndoorVirtualRaceForm(timezone=r.defaulttimezone)
 
-        
+
     breadcrumbs = [
         {
             'url':reverse('virtualevents_view'),
@@ -1753,7 +1718,7 @@ def indoorvirtualevent_create_view(request):
 @login_required()
 def virtualevent_create_view(request):
     r = getrower(request.user)
-        
+
     if request.method == 'POST':
         racecreateform = VirtualRaceForm(request.POST)
         if racecreateform.is_valid():
@@ -1779,7 +1744,7 @@ def virtualevent_create_view(request):
             startdatetime = datetime.datetime.combine(startdate,start_time)
             enddatetime = datetime.datetime.combine(enddate,end_time)
 
-            
+
             startdatetime = pytz.timezone(timezone_str).localize(
                 startdatetime
             )
@@ -1805,8 +1770,8 @@ def virtualevent_create_view(request):
                 registration_closure = enddatetime
             else:
                 registration_closure = evaluation_closure
-                
-            
+
+
             vs = VirtualRace(
                 name=name,
                 startdate=startdate,
@@ -1842,7 +1807,7 @@ def virtualevent_create_view(request):
                 ),
                 dotweet = dotweet
                 )
-            
+
             sa.save()
             url = reverse('virtualevents_view')
             return HttpResponseRedirect(url)
@@ -1850,7 +1815,7 @@ def virtualevent_create_view(request):
 
         racecreateform = VirtualRaceForm()
 
-        
+
     breadcrumbs = [
         {
             'url':reverse('virtualevents_view'),
@@ -1872,15 +1837,12 @@ def virtualevent_create_view(request):
                   })
 
 @login_required()
+@permission_required('virtualevent.change_race',fn=get_virtualevent_by_pk,raise_exception=True)
 def virtualevent_edit_view(request,id=0):
     r = getrower(request.user)
-        
-    try:
-        race = VirtualRace.objects.get(id=id)
-        if race.manager != request.user:
-            raise PermissionDenied("Access denied")
-    except VirtualRace.DoesNotExist:
-        raise Http404("Virtual Race does not exist")
+    race = get_object_or_404(VirtualRace,pk=id)
+
+
 
     start_time = race.start_time
     start_date = race.startdate
@@ -1900,7 +1862,7 @@ def virtualevent_edit_view(request,id=0):
         racecreateform = VirtualRaceForm(request.POST,instance=race)
         if racecreateform.is_valid():
             cd = racecreateform.cleaned_data
-            
+
             res, message = update_virtualrace(race,cd)
 
             if res:
@@ -1912,7 +1874,7 @@ def virtualevent_edit_view(request,id=0):
                           kwargs = {
                               'id':race.id
                               })
-            
+
             return HttpResponseRedirect(url)
 
     else:
@@ -1937,7 +1899,7 @@ def virtualevent_edit_view(request,id=0):
             'name': 'Edit'
             }
         ]
-        
+
     buttons = []
 
     if not request.user.is_anonymous:
@@ -1970,15 +1932,10 @@ def virtualevent_edit_view(request,id=0):
                   })
 
 @login_required()
+@permission_required('virtualevent.change_race',fn=get_virtualevent_by_pk,raise_exception=True)
 def indoorvirtualevent_edit_view(request,id=0):
     r = getrower(request.user)
-        
-    try:
-        race = VirtualRace.objects.get(id=id)
-        if race.manager != request.user:
-            raise PermissionDenied("Access denied")
-    except VirtualRace.DoesNotExist:
-        raise Http404("Virtual Race does not exist")
+    race = get_object_or_404(VirtualRace,pk=id)
 
     start_time = race.start_time
     start_date = race.startdate
@@ -1998,7 +1955,7 @@ def indoorvirtualevent_edit_view(request,id=0):
         racecreateform = IndoorVirtualRaceForm(request.POST,instance=race)
         if racecreateform.is_valid():
             cd = racecreateform.cleaned_data
-            
+
             res, message = update_indoorvirtualrace(race,cd)
 
             if res:
@@ -2010,14 +1967,14 @@ def indoorvirtualevent_edit_view(request,id=0):
                           kwargs = {
                               'id':race.id
                               })
-            
+
             return HttpResponseRedirect(url)
 
     else:
 
         racecreateform = IndoorVirtualRaceForm(instance=race)
 
-        
+
     breadcrumbs = [
         {
             'url':reverse('virtualevents_view'),
@@ -2057,8 +2014,8 @@ def indoorvirtualevent_edit_view(request,id=0):
 
         if race_can_edit(r,race):
             buttons += ['editbutton']
-    
-    
+
+
     return render(request,'virtualeventedit.html',
                   {
                       'form':racecreateform,
@@ -2084,7 +2041,7 @@ def virtualevent_submit_result_view(request,id=0,workoutid=0):
     start_date = race.startdate
     startdatetime = datetime.datetime.combine(start_date, start_time)
     startdatetime = pytz.timezone(race.timezone).localize(startdatetime)
-    
+
     end_time = race.end_time
     end_date = race.enddate
     enddatetime = datetime.datetime.combine(end_date, end_time)
@@ -2096,7 +2053,7 @@ def virtualevent_submit_result_view(request,id=0,workoutid=0):
         resultobj = VirtualRaceResult
     else:
         resultobj = IndoorVirtualRaceResult
-        
+
     records = resultobj.objects.filter(
         userid = r.id,
         race=race
@@ -2104,7 +2061,7 @@ def virtualevent_submit_result_view(request,id=0,workoutid=0):
 
 
     entrychoices = []
-    
+
     for record in records:
         rtpl = (record.id, record.__str__())
         entrychoices.append(rtpl)
@@ -2121,7 +2078,7 @@ def virtualevent_submit_result_view(request,id=0,workoutid=0):
                           }
                       )
         return HttpResponseRedirect(url)
-    
+
     ws = Workout.objects.filter(
         user=r,
         workouttype__in=mytypes.rowtypes,
@@ -2134,14 +2091,14 @@ def virtualevent_submit_result_view(request,id=0,workoutid=0):
             request,
             'You have no workouts executed during the race window. Please upload a result or enter it manually.'
         )
-        
+
         url = reverse('virtualevent_view',
                       kwargs = {
                           'id':id
                           })
 
         return HttpResponseRedirect(url)
-        
+
 
     initialworkouts = [w.id for w in Workout.objects.filter(
         user=r,plannedsession=race
@@ -2151,7 +2108,7 @@ def virtualevent_submit_result_view(request,id=0,workoutid=0):
     workoutdata['initial'] = []
 
     choices = []
-    
+
     for w in ws:
         wtpl = (w.id, w.__str__())
         choices.append(wtpl)
@@ -2183,7 +2140,7 @@ def virtualevent_submit_result_view(request,id=0,workoutid=0):
                 result,comments,errors,jobid = add_workout_indoorrace(
                     workouts,race,r,recordid=recordid)
 
-            
+
             for c in comments:
                 messages.info(request,c)
             for er in errors:
@@ -2217,13 +2174,13 @@ def virtualevent_submit_result_view(request,id=0,workoutid=0):
                             race.id
                             )
 
-                
+
             # redirect to race page
             url = reverse('virtualevent_view',
                           kwargs = {
                               'id':race.id
                           })
-            
+
             return HttpResponseRedirect(url)
 
     else:
@@ -2273,7 +2230,7 @@ def virtualevent_submit_result_view(request,id=0,workoutid=0):
         if race_can_edit(r,race):
             buttons += ['editbutton']
 
-    
+
     return render(request,'race_submit.html',
                   {
                       'race':race,

rowers/views/statements.py

@@ -19,6 +19,7 @@ from django.db.models import Q
 from django import template
 from django.db import IntegrityError, transaction
 from django.views.decorators.csrf import csrf_exempt
+from django.shortcuts import get_object_or_404
 from matplotlib.backends.backend_agg import FigureCanvas
 import gc
 from pyparsing import ParseException
@@ -31,10 +32,22 @@ from icalendar import Calendar, Event
 
 from functools import reduce
 
+from rules.contrib.views import PermissionRequiredMixin
+
 import rowers.braintreestuff as braintreestuff
 import rowers.payments as payments
 from rowers.opaque import encoder
 
+from rowers.rower_rules import (
+    ispromember,is_coach_user,is_team_member,is_rower_team_member,
+    is_workout_user,isplanmember,can_delete_session,
+    can_view_target,can_change_target,can_delete_target,
+    can_view_plan,can_change_plan,can_delete_plan,
+    can_view_cycle,can_change_cycle,can_delete_cycle,
+    can_add_workout_member,can_plan_user,is_paid_coach,
+    can_start_trial, can_start_plantrial,can_plan,is_workout_team
+    )
+
 from django.shortcuts import render
 from django.template.loader import render_to_string
 
@@ -97,7 +110,7 @@ from rowers.models import (
     TrainingMesoCycleForm, TrainingMicroCycleForm,
     RaceLogo,RowerBillingAddressForm,PaidPlan,
     AlertEditForm, ConditionEditForm,
-    PlannedSessionComment,CoachRequest,CoachOffer,checkaccessplanuser,
+    PlannedSessionComment,CoachRequest,CoachOffer,
     VideoAnalysis
     )
 from rowers.models import (
@@ -240,7 +253,7 @@ from rq import Queue,cancel_job
 from django.core.cache import cache
 from django_mailbox.models import Message,Mailbox,MessageAttachment
 
-
+from rules.contrib.views import permission_required, objectgetter
 
 # Utility to get stroke data in a JSON response
 class JSONResponse(HttpResponse):
@@ -274,6 +287,49 @@ def getfavorites(r,row):
 
     return favorites,maxfav
 
+def get_logo_by_pk(request,*args,**kwargs):
+    id = kwargs['id']
+    return get_object_or_404(RaceLogo,pk=id)
+
+def get_virtualevent_by_pk(request,*args,**kwargs):
+    id = kwargs['id']
+    return get_object_or_404(VirtualRace,pk=id)
+
+def get_promember(request,*args,**kwargs):
+    return request.user
+
+def get_course_by_pk(request,*args,**kwargs):
+    id = kwargs['id']
+    return get_object_or_404(GeoCourse,pk=id)
+
+def get_workout_by_opaqueid(request,id,**kwargs):
+    pk = encoder.decode_hex(id)
+    return get_object_or_404(Workout,pk=pk)
+
+def get_session_by_pk(request,*args,**kwargs):
+    id = kwargs['id']
+    return get_object_or_404(PlannedSession,pk=id)
+
+def get_target_by_pk(request,*args,**kwargs):
+    id = kwargs['id']
+    return get_object_or_404(TrainingTarget,pk=id)
+
+def get_plan_by_pk(request,*args,**kwargs):
+    id = kwargs['id']
+    return get_object_or_404(TrainingPlan,pk=id)
+
+def get_macro_by_pk(request,*args,**kwargs):
+    id = kwargs['id']
+    return get_object_or_404(TrainingMacroCycle,pk=id)
+
+def get_meso_by_pk(request,*args,**kwargs):
+    id = kwargs['id']
+    return get_object_or_404(TrainingMesoCycle,pk=id)
+
+def get_micro_by_pk(request,*args,**kwargs):
+    id = kwargs['id']
+    return get_object_or_404(TrainingMicroCycle,pk=id)
+
 def get_workout_default_page(request,id):
     if request.user.is_anonymous:
         return reverse('workout_view',kwargs={'id':id})
@@ -284,11 +340,42 @@ def get_workout_default_page(request,id):
         else:
             return reverse('workout_workflow_view',kwargs={'id':id})
 
-def getrequestrower(request,rowerid=0,userid=0,notpermanent=False):
+def get_user_by_userid(*args,**kwargs):
+    request = args[0]
+    try:
+        id = kwargs['userid']
+    except KeyError:
+        id = request.user.id
 
+    if id is not None and int(id) == 0:
+        id = request.user.id
+
+    u = get_object_or_404(User,pk=id)
+    return u
+
+def get_user_by_id(*args,**kwargs):
+    request = args[0]
+    try:
+        id = args[1]
+    except IndexError:
+        try:
+            id = kwargs['id']
+        except KeyError:
+            id = request.user.id
+
+    return get_object_or_404(User,pk=id)
+
+def get_rower_by_id(request,id):
+    u = User.objects.get(id=id)
+    return u.rower
+
+def getrequestrower(request,rowerid=0,userid=0,notpermanent=False):
     userid = int(userid)
     rowerid = int(rowerid)
 
+    if userid == 0:
+        userid = request.user.id
+
     if notpermanent == False:
         if rowerid == 0 and 'rowerid' in request.session:
             rowerid = request.session['rowerid']
@@ -300,16 +387,25 @@ def getrequestrower(request,rowerid=0,userid=0,notpermanent=False):
 
         if rowerid != 0:
             r = Rower.objects.get(id=rowerid)
+            u = r.user
         elif userid != 0:
             u = User.objects.get(id=userid)
             r = getrower(u)
+        elif request.user.is_anonymous:
+            return None
         else:
             r = getrower(request.user)
+            u = r.user
+
 
     except Rower.DoesNotExist:
         raise Http404("Rower doesn't exist")
 
-    if not checkaccessuser(request.user,r):
+    if r.user == request.user:
+        return r
+
+    if userid != 0 and not is_rower_team_member(request.user,u.rower):
+        request.session['rowerid'] = request.user.rower.id
         raise PermissionDenied("You have no access to this user")
 
     if notpermanent == False:
@@ -342,7 +438,8 @@ def getrequestplanrower(request,rowerid=0,userid=0,notpermanent=False):
     except Rower.DoesNotExist:
         raise Http404("Rower doesn't exist")
 
-    if not checkaccessplanuser(request.user,r):
+    if r.user != request.user and not can_plan_user(request.user,r ):
+        request.session['rowerid'] = r.id
         raise PermissionDenied("You have no access to this user")
 
     if notpermanent == False:
@@ -376,21 +473,6 @@ def get_workout(id):
 
     return w
 
-def get_workout_permitted(user,id):
-    w = get_workout(id)
-
-    if (checkworkoutuser(user,w)==False):
-        raise PermissionDenied("Access denied")
-
-    return w
-
-def get_workout_permittedview(user,id):
-    w = get_workout(id)
-
-    if (checkworkoutuserview(user,w)==False):
-        raise PermissionDenied("Access denied")
-
-    return w
 
 def getvalue(data):
     perc = 0
@@ -432,7 +514,6 @@ class SessionTaskListener(threading.Thread):
         for item in self.pubsub.listen():
             if item['data'] == "KILL":
                 self.pubsub.unsubscribe()
-                print(self, "unsubscribed and finished")
                 break
             else:
                 self.work(item)
@@ -773,9 +854,9 @@ def get_stored_tasks_status(request):
 
     return taskstatus
 
-@login_required()
+@permission_required('workout.change_workout',fn=get_workout_by_opaqueid,raise_exception=True)
 def get_thumbnails(request,id):
-    row = get_workout_permitted(request.user,id)
+    row = get_workout_by_opaqueid(request,id)
 
 
     r = getrower(request.user)
@@ -860,27 +941,6 @@ def get_blog_posts_old(request):
 
 
 
-@login_required()
-def get_testscript(request,id):
-    row = get_workout_permitted(request.user,id)
-    r = getrower(request.user)
-
-    object = {
-        "script":"""
-<div id="id_script">
-    <script>alert("hi")</script>
-</div>
-        """,
-        "div":"""
-<div id="id_div">
-Hoi
-</div>
-"""
-        }
-
-
-    return JSONResponse([object,object])
-
 @login_required()
 def session_jobs_view(request):
     taskstatus = get_stored_tasks_status(request)
@@ -923,10 +983,10 @@ def rowhascoordinates(row):
 def rdata(file,rower=rrower()):
     try:
         res = rrdata(csvfile=file,rower=rower)
-    except (IOError, IndexError, EOFError):
+    except (IOError, IndexError, EOFError,FileNotFoundError):
         try:
             res = rrdata(csvfile=file+'.gz',rower=rower)
-        except (IOError, IndexError, EOFError):
+        except (IOError, IndexError, EOFError,FileNotFoundError):
             res = 0
 
     return res
@@ -989,10 +1049,6 @@ from rowers.utils import (
 
 import rowers.datautils as datautils
 
-from rowers.models import (
-    checkworkoutuser,checkaccessuser,checkviewworkouts,checkworkoutuserview
-    )
-
 # Check if a user is a Coach member
 def iscoachmember(user):
     if not user.is_anonymous:
@@ -1008,56 +1064,9 @@ def iscoachmember(user):
 
     return result
 
-def cancreateteam(user):
-    if user.is_anonymous:
-        return False
-
-    try:
-        r = Rower.objects.get(user=user)
-    except Rower.DoesNotExist:
-        r = Rower(user=user)
-        r.save()
-
-    if user.is_authenticated and ('coach' in r.rowerplan):
-        return True
-    elif user.is_athenticated() and r.rowerplan in ['plan','pro']:
-        ts = Team.objects.filter(manager=user)
-        if len(otherteams) >= 1:
-            return False
-
-# Check if a user can create planned sessions
-def hasplannedsessions(user):
-    if not user.is_anonymous:
-        try:
-            r = Rower.objects.get(user=user)
-        except Rower.DoesNotExist:
-            r = Rower(user=user)
-            r.save()
-
-        result = user.is_authenticated and (r.rowerplan=='coach' or r.rowerplan=='freecoach' or r.rowerplan=='plan')
-        if not result and r.plantrialexpires:
-            result = user.is_authenticated and r.plantrialexpires >= datetime.date.today()
-    else:
-        result = False
-
-    return result
 
 from rowers.utils import ProcessorCustomerError
-from rowers.utils import isprorower
 
-# Check if a user is a Pro member
-def ispromember(user):
-    if user and not user.is_anonymous:
-        try:
-            r = Rower.objects.get(user=user)
-        except Rower.DoesNotExist:
-            r = Rower(user=user)
-            r.save()
-
-        result = user.is_authenticated and isprorower(r)
-    else:
-        result = False
-    return result
 
 # More User/Rower utils
 def add_defaultfavorites(r):

rowers/views/teamviews.py

@@ -5,9 +5,16 @@ from __future__ import unicode_literals
 
 from rowers.views.statements import *
 
+from rowers.rower_rules import *
+
+def get_team_by_pk(request,team_id):
+    return get_object_or_404(Team,pk=team_id)
+
+
 
 @login_required()
-def team_view(request,id=0,userid=0):
+@permission_required('teams.view_team',fn=get_team_by_pk,raise_exception=True)
+def team_view(request,team_id=0,userid=0):
     ismember = 0
     hasrequested = 0
     r = getrequestrower(request,userid=userid)
@@ -15,26 +22,21 @@ def team_view(request,id=0,userid=0):
     myteams, memberteams, otherteams = get_teams(request)
     teams.remove_expired_invites()
 
+    t = get_object_or_404(Team,pk=team_id)
 
-    
-    try:
-        t = Team.objects.get(id=id)
-    except Team.DoesNotExist:
-        raise Http404("Team doesn't exist")
+    #if r.rowerplan == 'basic' and t.manager.rower.rowerplan != 'coach':
+    #    raise PermissionDenied("You need to be on a Paid Plan to see or join this team")
 
-    if r.rowerplan == 'basic' and t.manager.rower.rowerplan != 'coach':
-        raise PermissionDenied("You need to be on a Paid Plan to see or join this team")
 
-    
     q = User.objects.filter(rower__isnull=False,rower__team__in=myteams).distinct().exclude(rower__team__name=t.name)
     mygroups = [request.user.rower.mycoachgroup]
     q2 = User.objects.filter(rower__isnull=False,rower__coachinggroups__in=mygroups).distinct().exclude(rower__team__name=t.name)
-        
+
     q = q | q2
-    
+
     if request.method == 'POST' and request.user == t.manager and 'email' in request.POST:
         inviteform = TeamInviteForm(request.POST)
-        
+
         inviteform.fields['user'].queryset = q
         if inviteform.is_valid():
             cd = inviteform.cleaned_data
@@ -59,7 +61,7 @@ def team_view(request,id=0,userid=0):
             teams.send_team_message(t,message)
             messages.info(request,'Message was sent to all team members')
         groupmessageform = TeamMessageForm()
-                
+
     elif request.user == t.manager:
         inviteform = TeamInviteForm()
         inviteform.fields['user'].queryset = q
@@ -68,7 +70,7 @@ def team_view(request,id=0,userid=0):
         inviteform = ''
         groupmessageform = ''
 
-        
+
     members = Rower.objects.filter(team=t).order_by('user__last_name','user__first_name')
     thisteammyrequests = TeamRequest.objects.filter(team=t,user=request.user)
     if len(thisteammyrequests):
@@ -83,7 +85,7 @@ def team_view(request,id=0,userid=0):
             'name': 'Groups'
             },
         {
-            'url':reverse(team_view,kwargs={'id':id}),
+            'url':reverse(team_view,kwargs={'team_id':team_id}),
             'name': t.name
             }
         ]
@@ -112,14 +114,14 @@ def team_leaveconfirm_view(request,id=0):
         raise Http404("Team doesn't exist")
 
     myteams, memberteams, otherteams = get_teams(request)
-    
+
     breadcrumbs = [
         {
             'url':reverse(rower_teams_view),
             'name': 'Groups'
             },
         {
-            'url':reverse(team_view,kwargs={'id':id}),
+            'url':reverse(team_view,kwargs={'team_id':id}),
             'name': t.name
             },
         {
@@ -144,7 +146,7 @@ def rower_calcdps_view(request):
 
     ws = [(w.id,w.csvfilename) for w in Workout.objects.filter(user=r)]
     res = myqueue(queue,handle_updatedps,r.user.email,ws,debug=False,
-                  emailbounced=r.emailbounced) 
+                  emailbounced=r.emailbounced)
 
     messages.info(request,"Your workouts are being updated in the background. You will receive email when this is done.")
 
@@ -155,7 +157,7 @@ def rower_calcdps_view(request):
 def team_leave_view(request,id=0):
     r = getrower(request.user)
     teams.remove_member(id,r)
-                            
+
     url = reverse(rower_teams_view)
     response = HttpResponseRedirect(url)
     return response
@@ -164,7 +166,7 @@ from rowers.forms import TeamInviteCodeForm
 
 def get_teams(request):
     r = Rower.objects.get(user=request.user)
-    
+
     myteams = Team.objects.filter(
         manager=request.user).order_by('name')
     memberteams = Team.objects.filter(
@@ -191,7 +193,7 @@ def rower_teams_view(request):
                 messages.error(request,text)
     else:
         form = TeamInviteCodeForm()
-            
+
     r = getrower(request.user)
     ts = Team.objects.filter(rower=r)
 
@@ -208,7 +210,7 @@ def rower_teams_view(request):
     mycoachoffers = CoachOffer.objects.filter(coach=r)
     # user is invited (by coach)
     coachoffers = CoachOffer.objects.filter(user=r.user)
-    
+
     # user requests a coach
     mycoachrequests = CoachRequest.objects.filter(user=r.user)
     # user is requested to coach
@@ -230,7 +232,7 @@ def rower_teams_view(request):
     potentialcoaches = [c for c in potentialcoaches if c.rower not in invitedcoaches+coaches]
     potentialcoaches = [c for c in potentialcoaches if teams.get_coach_club_size(c.rower)<c.rower.clubsize]
 
-    
+
     coachees = teams.coach_getcoachees(request.user.rower)
 
     if request.user.rower.rowerplan == 'coach':
@@ -253,7 +255,7 @@ def rower_teams_view(request):
         potentialathletes = []
 
     potentialathletes = [a for a in potentialathletes if a.user not in invitingathletes]
-    
+
     #    clubsize = teams.count_invites(request.user)+teams.count_club_members(request.user)
     #   max_clubsize = r.clubsize
 
@@ -265,7 +267,7 @@ def rower_teams_view(request):
             }
         ]
 
-    
+
     return render(request, 'teams.html',
 		  {
                       'teams':ts,
@@ -312,7 +314,7 @@ def manager_member_drop_view(request,teamid,userid,
         messages.info(request,text)
     else:
         messages.error(request,text)
-        
+
     url = reverse(rower_teams_view)
 
     return HttpResponseRedirect(url)
@@ -435,22 +437,23 @@ def team_requestmembership_view(request,teamid,userid):
 
     r = getrequestrower(request,userid=userid)
 
-    if t.manager.rower.rowerplan in ['plan','pro'] and r.rowerplan == 'basic':
+    #if t.manager.rower.rowerplan in ['plan','pro'] and r.rowerplan == 'basic':
+    if not can_join_team(r.user,t):
         messages.error(request,
                        "You have to be on a paid plan (Pro or higher) to join this team. As a basic user you can only join teams managed by users on the Coach plan.")
 
-        url = reverse('paidplans')
+        url = reverse('paidplans_view')
         return HttpResponseRedirect(url)
-    
+
     res,text = teams.create_request(t,userid)
     if res:
         messages.info(request,text)
     else:
         messages.error(request,text)
 
-        
+
     url = reverse('team_view',kwargs={
-	'id':int(teamid),
+	'team_id':int(teamid),
         })
 
 
@@ -571,7 +574,7 @@ def rower_invitations_view(request,code=None,message='',successmessage=''):
             messages.info(request,text)
             teamid=res
             url = reverse(team_view,kwargs={
-	        'id':teamid,
+	        'team_id':teamid,
             })
         else:
             messages.error(request,text)
@@ -583,14 +586,13 @@ def rower_invitations_view(request,code=None,message='',successmessage=''):
     url = reverse(rower_teams_view,kwargs={
     })
     return HttpResponseRedirect(url)
-    
+
 @login_required()
-def team_edit_view(request,id=0):
-    try:
-        t = Team.objects.get(id=id)
-    except Team.DoesNotExist:
-        raise Http404("Team does not exist")
-        
+@permission_required('teams.change_team',fn=get_team_by_pk,raise_exception=True)
+def team_edit_view(request, team_id=0):
+    t = get_object_or_404(Team,pk=team_id)
+
+
     if request.method == 'POST':
         teamcreateform = TeamForm(request.POST,instance=t)
         if teamcreateform.is_valid():
@@ -609,10 +611,10 @@ def team_edit_view(request,id=0):
 
             url = reverse(team_view,
                           kwargs={
-                              'id':int(id),
+                              'team_id':int(team_id),
                           }
             )
-                
+
             response = HttpResponseRedirect(url)
             return response
 
@@ -620,18 +622,18 @@ def team_edit_view(request,id=0):
         teamcreateform = TeamForm(instance=t)
 
     myteams, memberteams, otherteams = get_teams(request)
-    
+
     breadcrumbs = [
         {
             'url':reverse(rower_teams_view),
             'name': 'Groups'
             },
         {
-            'url':reverse(team_view,kwargs={'id':id}),
+            'url':reverse(team_view,kwargs={'team_id':team_id}),
             'name': t.name
             },
         {
-            'url':reverse(team_edit_view,kwargs={'id':id}),
+            'url':reverse(team_edit_view,kwargs={'team_id':team_id}),
             'name': 'Edit'
             }
         ]
@@ -648,19 +650,11 @@ def team_edit_view(request,id=0):
                       'team':t,
                       })
 
-#@user_passes_test(cancreateteam,login_url="/rowers/paidplans",redirect_field_name=None)
 @login_required()
+@user_passes_test(can_add_team,login_url="/rowers/paidplans",redirect_field_name=None)
 def team_create_view(request):
     r = getrequestrower(request)
 
-    if r.rowerplan == 'basic':
-        if r.protrialexpires < timezone.now().date() and r.plantrialexpires < timezone.now().date():
-            messages.error(request,"You must upgrade to Pro or higher to create teams/training groups")
-            url = reverse('paidplans')
-            return HttpResponseRedirect(url)
-
-    
-    
     if request.method == 'POST':
         teamcreateform = TeamForm(request.POST)
         if teamcreateform.is_valid():
@@ -675,9 +669,9 @@ def team_create_view(request):
 
             if not res:
                 messages.error(request,message)
-                url = reverse('paidplans')
+                url = reverse('paidplans_view')
                 return HttpResponseRedirect(url)
-            
+
             url = reverse('rower_teams_view')
             response = HttpResponseRedirect(url)
             return response
@@ -686,7 +680,7 @@ def team_create_view(request):
         teamcreateform = TeamForm()
 
     myteams, memberteams, otherteams = get_teams(request)
-    
+
     breadcrumbs = [
         {
             'url':reverse(rower_teams_view),
@@ -708,29 +702,25 @@ def team_create_view(request):
                       'breadcrumbs':breadcrumbs,
                       })
 
-@login_required()
-def team_deleteconfirm_view(request,id):
+#@login_required()
+@permission_required('teams.delete_team',fn=get_team_by_pk,raise_exception=True)
+def team_deleteconfirm_view(request,team_id):
     r = getrower(request.user)
-    try:
-        t = Team.objects.get(id=id)
-    except Team.DoesNotExist:
-        raise Http404("This team doesn't exist")
-    if t.manager != request.user:
-        raise PermissionDenied("You are not allowed to delete this team")
+    t = get_object_or_404(Team,pk=team_id)
 
     myteams, memberteams, otherteams = get_teams(request)
-    
+
     breadcrumbs = [
         {
             'url':reverse(rower_teams_view),
             'name': 'Groups'
             },
         {
-            'url':reverse(team_view,kwargs={'id':id}),
+            'url':reverse(team_view,kwargs={'team_id':team_id}),
             'name': t.name
             },
         {
-            'url':reverse(team_deleteconfirm_view,kwargs={'id':id}),
+            'url':reverse(team_deleteconfirm_view,kwargs={'team_id':team_id}),
             'name': 'Leave'
             }
         ]
@@ -745,52 +735,44 @@ def team_deleteconfirm_view(request,id):
                   })
 
 @login_required()
-def team_delete_view(request,id):
+@permission_required('teams.delete_team',fn=get_team_by_pk,raise_exception=True)
+def team_delete_view(request,team_id):
     r = getrower(request.user)
-    try:
-        t = Team.objects.get(id=id)
-    except Team.DoesNotExist:
-        raise Http404("This team doesn't exist")
-    if t.manager != request.user:
-        raise PermissionDenied("You are not allowed to delete this team")
+    t = get_object_or_404(Team,pk=team_id)
 
     teams.remove_team(t.id)
-    
+
     url = reverse(rower_teams_view)
     response = HttpResponseRedirect(url)
     return response
 
 @login_required()
-def team_members_stats_view(request,id):
+@permission_required('teams.change_team',fn=get_team_by_pk,raise_exception=True)
+def team_members_stats_view(request,team_id):
     r = getrower(request.user)
-    try:
-        t = Team.objects.get(id=id)
-    except Team.DoesNotExist:
-        raise Http404("This team doesn't exist")
-    if t.manager != request.user:
-        raise PermissionDenied("You are not allowed to see this page")
+    t = get_object_or_404(Team,pk=team_id)
 
     members = Rower.objects.filter(team=t).order_by("user__last_name","user__first_name")
-    
+
     theusers = [member.user for member in members]
 
     myteams, memberteams, otherteams = get_teams(request)
-    
+
     breadcrumbs = [
         {
             'url':reverse(rower_teams_view),
             'name': 'Groups'
             },
         {
-            'url':reverse(team_view,kwargs={'id':id}),
+            'url':reverse(team_view,kwargs={'team_id':team_id}),
             'name': t.name
             },
         {
-            'url':reverse(team_members_stats_view,kwargs={'id':id}),
+            'url':reverse(team_members_stats_view,kwargs={'team_id':team_id}),
             'name': 'Members Stats'
             }
         ]
-    
+
     response = render(request,'teamstats.html',
                   {
                       'teams':get_my_teams(request.user),

rowers/views/userviews.py

@@ -5,6 +5,120 @@ from __future__ import unicode_literals
 
 from rowers.views.statements import *
 
+@login_required()
+def deactivate_user(request):
+    pk = request.user.id
+    user = User.objects.get(pk=pk)
+    user_form = DeactivateUserForm(instance=user)
+    if request.user.is_authenticated and request.user.id == user.id:
+        if request.method == "POST":
+            user_form = DeactivateUserForm(request.POST, instance=user)
+            if user_form.is_valid():
+                if not user_form.cleaned_data['is_active']:
+                    r = Rower.objects.get(user=user)
+                    if r.paidplan is not None and r.paidplan.paymentprocessor == 'braintree':
+                        try:
+                            subscriptions = braintreestuff.find_subscriptions(r)
+                            for subscription in subscriptions:
+                                success, themessages,errormessages = braintreestuff.cancel_subscription(r,id)
+                                for message in themessages:
+                                    messages.info(request,message)
+                        except ProcessorCustomerError:
+                            pass
+
+                        r.paidplan = None
+                        r.teamplanexpires = timezone.now()
+                        r.planexpires = timezone.now()
+                        r.clubsize = 0
+                        r.rowerplan = 'basic'
+                        r.save()
+
+                    deactivate_user = user_form.save(commit=False)
+                    user.is_active = False
+                    user.save()
+                    deactivate_user.save()
+                    #                url = reverse(auth_views.logout_then_login)
+                    url = '/logout/?next=/login'
+                    return HttpResponseRedirect(url)
+
+        return render(request, "userprofile_deactivate.html", {
+            "user_form": user_form,
+        })
+    else:
+        raise PermissionDenied
+
+@login_required()
+def user_gdpr_optin(request):
+    r = getrower(request.user)
+    r.gdproptin = False
+    r.gdproptindate = None
+    r.save()
+    nexturl = request.GET.get('next','/rowers/list-workouts/')
+    if r.gdproptin:
+        return HttpResponseRedirect(nexturl)
+
+    return render(request,'gdpr_optin.html',{
+        "next": nexturl
+        })
+
+@login_required()
+def user_gdpr_confirm(request):
+    r = getrower(request.user)
+    r.gdproptin = True
+    r.gdproptindate = timezone.now()
+    r.save()
+
+    nexturl = request.GET.get('next','/rowers/list-workouts/')
+
+    return HttpResponseRedirect(nexturl)
+
+
+
+@login_required()
+def remove_user(request):
+    pk = request.user.id
+    user = User.objects.get(pk=pk)
+    user_form = DeleteUserForm(instance=user)
+    if request.user.is_authenticated and request.user.id == user.id:
+        if request.method == "POST":
+            user_form = DeleteUserForm(request.POST,instance=user)
+            if user_form.is_valid():
+                cd = user_form.cleaned_data
+                name = user.first_name+' '+user.last_name
+                email = user.email
+
+                r = Rower.objects.get(user=user)
+                if r.paidplan is not None and r.paidplan.paymentprocessor == 'braintree':
+                    try:
+                        subscriptions = braintreestuff.find_subscriptions(r)
+                        for subscription in subscriptions:
+                            success, themessages,errormessages = braintreestuff.cancel_subscription(r,id)
+                        for message in themessages:
+                            messages.info(request,message)
+                    except:
+                        pass
+
+                if cd['delete_user']:
+                    # delete workouts
+                    Workout.objects.filter(user=user.rower).delete()
+                    # delete planned sessions
+                    PlannedSession.objects.filter(manager=user).delete()
+
+                    user.delete()
+                    res = myqueue(queuehigh,
+                                  handle_sendemail_userdeleted,
+                                  name, email)
+
+                    url = '/logout/?next=/login'
+#                    url = reverse(auth_views.logout_then_login)
+                    return HttpResponseRedirect(url)
+        return render(request, "userprofile_delete.html", {
+            "user_form": user_form,
+            })
+    else:
+        raise PermissionDenied
+
+
 @login_required()
 def survey(request):
 
@@ -34,7 +148,7 @@ def survey(request):
 def start_trial_view(request):
     r = getrower(request.user)
 
-    if r.protrialexpires > datetime.date(1970,1,1):
+    if not can_start_trial(request.user):
         messages.error(request,'You do not qualify for a trial')
         url = '/rowers/paidplans'
         return HttpResponseRedirect(url)
@@ -68,7 +182,7 @@ def start_trial_view(request):
 def start_plantrial_view(request):
     r = getrower(request.user)
 
-    if r.plantrialexpires > datetime.date(1970,1,1):
+    if not can_start_plantrial(request.user):
         messages.error(request,'You do not qualify for a trial')
         url = '/rowers/paidplans'
         return HttpResponseRedirect(url)
@@ -101,6 +215,7 @@ def start_plantrial_view(request):
 
 # Page where user can manage his favorite charts
 @login_required()
+@permission_required('rower.is_coach',fn=get_user_by_userid,raise_exception=True)
 def rower_favoritecharts_view(request,userid=0):
     message = ''
     successmessage = ''
@@ -168,6 +283,7 @@ def rower_favoritecharts_view(request,userid=0):
 
 # page where user sets his export settings
 @login_required()
+@permission_required('rower.is_coach',fn=get_user_by_userid,raise_exception=True)
 def rower_exportsettings_view(request,userid=0):
     r = getrequestrower(request,userid=userid)
     if request.method == 'POST':
@@ -204,6 +320,7 @@ def rower_exportsettings_view(request,userid=0):
 # Page where user can set his details
 # Add email address to form so user can change his email address
 @login_required()
+@permission_required('rower.is_coach',fn=get_user_by_userid,raise_exception=True)
 def rower_edit_view(request,rowerid=0,userid=0,message=""):
     r = getrequestrower(request,rowerid=rowerid,userid=userid,notpermanent=True)
 
@@ -299,6 +416,7 @@ def rower_edit_view(request,rowerid=0,userid=0,message=""):
 # Page where user can set his details
 # Add email address to form so user can change his email address
 @login_required()
+@permission_required('rower.is_coach',fn=get_user_by_userid,raise_exception=True)
 def rower_prefs_view(request,userid=0,message=""):
     r = getrequestrower(request,userid=userid,notpermanent=True)
 

rowers/weather.py

@@ -4,6 +4,7 @@ from __future__ import print_function
 from __future__ import unicode_literals
 from __future__ import unicode_literals, absolute_import
 import requests
+from requests.exceptions import ConnectionError
 import json
 from lxml import objectify,etree
 import xml.etree.ElementTree as ET
@@ -26,13 +27,16 @@ def get_airport_code(lat,lon):
     newlon = a.iloc[0]['lon']
     distance = geo_distance(lat,lon,newlat,newlon)
     return airport_code,newlat,newlon,distance
-    
+
 # Get weather data from the DarkSky API
 def get_weather_data(long,lat,unixtime):
     url = "https://api.darksky.net/forecast/"+FORECAST_IO_KEY+"/"
     url += str(long)+","+str(lat)+","+str(unixtime)
 
-    s = requests.get(url)
+    try:
+        s = requests.get(url)
+    except ConnectionError:
+        return 0
 
     if s.ok:
         return s.json()
@@ -55,10 +59,14 @@ def get_metar_data(airportcode,unixtime):
     except:
         message = 'Failed to download METAR data'
         return [0,0,message,'','']
-        
+
 
     if s.ok:
-        doc = etree.fromstring(s.content)
+        try:
+            doc = etree.fromstring(s.content)
+        except AttributeError:
+            message = 'METAR data content error'
+            return [0,0,message,'',0]
         lengte = len(doc.xpath('data/METAR/station_id'))
         idnr = int(lengte/2)
         try:
@@ -77,7 +85,7 @@ def get_metar_data(airportcode,unixtime):
         wind_knots = float(wind_speed)
         wind_ms = 0.514444*wind_knots
         wind_ms = int(10*wind_ms)/10.
-        
+
         temperaturec = float(temp_c)
         temp_f = 32.+(9./5.)*temperaturec
         temp_f = str(int(10*temp_f)/10.)
@@ -87,17 +95,19 @@ def get_metar_data(airportcode,unixtime):
         message += '. Wind: '+str(wind_ms)+' m/s ('+str(wind_knots)+' kt)'
         message +='. Wind Bearing: '+str(windbearing)+' degrees'
 #        message +='\n'+rawtext
-        
+
         return [wind_ms,windbearing,message,rawtext,timestamp]
 
 
     message = 'Failed to download METAR data'
     return [0,0,message,'',timestamp]
 
-    
+
 # Get wind data (and translate from knots to m/s)
 def get_wind_data(lat,long,unixtime):
     data = get_weather_data(lat,long,unixtime)
+    summary = ''
+    temperature = 20
     if data:
         try:
             # we are getting wind in mph
@@ -107,11 +117,13 @@ def get_wind_data(lat,long,unixtime):
             windspeed = 0
             windbearing = 0
 
+
         try:
             airports = data['flags']['madis-stations']
         except KeyError:
             airports = ['unknown']
 
+
         try:
             temperature = data['currently']['temperature']
             # Temp is given in Fahrenheit, so convert to Celsius for Europeans
@@ -121,6 +133,7 @@ def get_wind_data(lat,long,unixtime):
             temperature = 'unknown'
             temperaturec = 'unknown'
 
+
         try:
             summary = data['currently']['summary']
         except KeyError:
@@ -128,15 +141,19 @@ def get_wind_data(lat,long,unixtime):
     else:
         windspeed = 0
         windbearing = 0
+        summary = 'unknown'
+        airports = ['unknown']
+        temparature = 'unknown'
+        temperaturec = 'unknown'
         message = 'Not able to get weather data'
 
     # apply Hellman's coefficient for neutral air above human
     # inhabitated areas
     windspeed = windspeed*(0.1)**0.34
     windspeed = 0.01*int(100*windspeed)
-    
+
     timestamp = arrow.get(unixtime).isoformat()
-    
+
     message = 'Summary for your location at '+timestamp+': '+summary
     message += '. Temperature '+str(temperature)+'F/'+str(temperaturec)+'C'
 

rowsandall_app/settings.py

@@ -73,11 +73,13 @@ INSTALLED_APPS = [
     'tz_detect',
     'django_social_share',
     'django_countries',
+	'rules',
 ]
 
 AUTHENTICATION_BACKENDS = (
     'oauth2_provider.backends.OAuth2Backend',
     # Uncomment following if you want to access the admin
+	'rules.permissions.ObjectPermissionBackend',
     'django.contrib.auth.backends.ModelBackend',
 )
 

rowsandall_app/urls.py

@@ -66,7 +66,7 @@ urlpatterns += [
         {'next_page': '/'},
         name='logout',),
     re_path(r'^rowers/',include('rowers.urls')),
-    re_path(r'^survey/',include('survey.urls')),
+#    re_path(r'^survey/',include('survey.urls')),
 #    re_path(r'^cvkbrno/',include('cvkbrno.urls')),
 #    re_path(r'^admin/rq/',include('django_rq_dashboard.urls')),
     re_path(r'^call\_back',rowersviews.rower_process_callback),

templates/newbase.html

@@ -246,7 +246,7 @@
             {% endif %}
           {% endif %}
           {% if user.rower.protrialexpires and user.rower.protrialexpires|is_future_date %}
-          {% if user.rower.plantrialexpires and user.rower.rowerplan != 'plan' %}
+          {% if user.rower.plantrialexpires and user.rower.plantrialexpires|is_future_date and user.rower.rowerplan != 'plan' %}
           <li class="grid_4">
             <p class="successmessage">
               {{ user.rower.protrialexpires|date_dif|ddays }} days left of your Self-Coach trial           - Would you like to <a href="/rowers/paidplans/">upgrade now?</a>