diff --git a/froide_govplan/auth.py b/froide_govplan/auth.py index e500a63..0dfb30d 100644 --- a/froide_govplan/auth.py +++ b/froide_govplan/auth.py @@ -1,3 +1,5 @@ +from django.db.models import Q + from .models import GovernmentPlan @@ -12,3 +14,14 @@ def get_allowed_plans(request): return GovernmentPlan.objects.all() groups = request.user.groups.all() return GovernmentPlan.objects.filter(group__in=groups).distinct() + + +def get_visible_plans(request): + if not has_limited_access(request.user): + return GovernmentPlan.objects.all() + if request.user.is_authenticated: + groups = request.user.groups.all() + return GovernmentPlan.objects.filter( + Q(public=True) | Q(group__in=groups) + ).distinct() + return GovernmentPlan.objects.filter(public=True) diff --git a/froide_govplan/views.py b/froide_govplan/views.py index 5508c84..cde841f 100644 --- a/froide_govplan/views.py +++ b/froide_govplan/views.py @@ -4,7 +4,7 @@ from django.shortcuts import get_object_or_404, redirect, render from django.utils.translation import gettext_lazy as _ from django.views.generic import DetailView, UpdateView -from .auth import get_allowed_plans +from .auth import get_visible_plans from .forms import GovernmentPlanUpdateProposalForm from .models import Government, GovernmentPlan, GovernmentPlanSection @@ -34,7 +34,7 @@ class GovPlanSectionDetailView(GovernmentMixin, DetailView): def get_context_data(self, **kwargs): context = super().get_context_data(**kwargs) - queryset = get_allowed_plans(self.request) + queryset = get_visible_plans(self.request) context["plans"] = context["object"].get_plans(queryset=queryset) return context