Repository: carpentries/amy
Issue: Steering Committee members aren't allowed into AMY

All access apart from AutoUpdateProfile is allowed only for admins, and people from Steering Committee have "steering committee" group which is not considered admin.

The workaround for now is that I'll add SC members to the "administrators" group.


Changed files:
workshops/models.py, workshops/test/test_security.py

diff --git a/workshops/models.py b/workshops/models.py
index 53a318ac..ef4a8ce2 100644
--- a/workshops/models.py
+++ b/workshops/models.py
@@ -422,7 +422,8 @@ def is_admin(user):
         return False
     else:
         return (user.is_superuser or
-                user.groups.filter(name='administrators').exists())
+                user.groups.filter(Q(name='administrators') |
+                                   Q(name='steering committee')).exists())
 
 
 class ProfileUpdateRequest(ActiveMixin, CreatedUpdatedMixin, models.Model):
diff --git a/workshops/test/test_security.py b/workshops/test/test_security.py
index 7f7f4b69..badff4ad 100644
--- a/workshops/test/test_security.py
+++ b/workshops/test/test_security.py
@@ -38,24 +38,34 @@ class TestViews(TestBase):
         super().setUp()
 
         admins = Group.objects.get(name='administrators')
+        steering_committee = Group.objects.get(name='steering committee')
 
-        # superuser who doesn't belong to Admin group
+        # superuser who doesn't belong to Admin group should have access to
+        # admin dashboard
         self.admin = Person.objects.create_superuser(
             username='superuser', personal='Super', family='User',
             email='superuser@example.org', password='superuser')
         assert admins not in self.admin.groups.all()
 
-        # user with access to admin dashboard
+        # user belonging to Admin group should have access to admin dashboard
         self.mentor = Person.objects.create_user(
             username='admin', personal='Bob', family='Admin',
             email='admin@example.org', password='admin')
         self.mentor.groups.add(admins)
 
+        # steering committee members should have access to admin dashboard too
+        self.committee = Person.objects.create_user(
+            username='committee', personal='Bob', family='Committee',
+            email='committee@example.org', password='committee',
+        )
+        self.committee.groups.add(steering_committee)
+
         # user with access only to trainee dashboard
         self.trainee = Person.objects.create_user(
             username='trainee', personal='Bob', family='Trainee',
             email='trainee@example.org', password='trainee')
         assert admins not in self.trainee.groups.all()
+        assert steering_committee not in self.trainee.groups.all()
 
     def assert_accessible(self, url, user=None):
         if user:
@@ -87,6 +97,7 @@ class TestViews(TestBase):
 
         self.assert_accessible(url, user='superuser')
         self.assert_accessible(url, user='admin')
+        self.assert_accessible(url, user='committee')
         self.assert_inaccessible(url, user='trainee')
         self.assert_inaccessible(url, user=None)
 
@@ -102,6 +113,7 @@ class TestViews(TestBase):
 
         self.assert_accessible(url, user='superuser')
         self.assert_accessible(url, user='admin')
+        self.assert_accessible(url, user='committee')
         self.assert_accessible(url, user='trainee')
         self.assert_inaccessible(url, user=None)
 
@@ -117,6 +129,7 @@ class TestViews(TestBase):
 
         self.assert_accessible(url, user='superuser')
         self.assert_accessible(url, user='admin')
+        self.assert_accessible(url, user='committee')
         self.assert_accessible(url, user='trainee')
         self.assert_accessible(url, user=None)
 
@@ -131,6 +144,7 @@ class TestViews(TestBase):
 
         self.assert_accessible(url, user='superuser')
         self.assert_accessible(url, user='admin')
+        self.assert_accessible(url, user='committee')
         self.assert_inaccessible(url, user='trainee')
         self.assert_inaccessible(url, user=None)
 
@@ -145,6 +159,7 @@ class TestViews(TestBase):
 
         self.assert_accessible(url, user='superuser')
         self.assert_accessible(url, user='admin')
+        self.assert_accessible(url, user='committee')
         self.assert_accessible(url, user='trainee')
         self.assert_accessible(url, user=None)