Repository: DDMAL/CantusDB

Issue:
Users should only be shown the View-Edit toggle if they have edit access for the source/chant in question
@annamorphism made a comment on #441 that really deserves its own issue

> also is there a way to not have the "Edit" tab show up for unauthorized people? it's annoying to try to edit something and then be sent to a 403.

Currently, the view-edit toggle is being displayed whenever the user is logged in. Instead, we need to properly check that the user is actually allowed to edit the chant before displaying the Edit link.


Discussion:
I will also add here, as I did there, that it would be good to make sure that in doing so we aren't restricting edit capabilities more than we want to. e.g. are users who on OldCantus are allowed to fix a quick typo in any chant now only allowed to do so if the creator of the chant grants them access? and if so, is that a good thing (fewer unauthorized edits) or a bad one (every tiny correction has to go through an admin)?  
I only have the one Debra-level account on OldCantus, so I can't check what various levels of user are allowed to do as it stands. 
hm... I know that permissions are slightly different/simplified on NewCantus compared to on OldCantus, but everything on NewCantus should currently be in alignment with a specification that was agreed upon by Junhao and by Debra. I'm sure there are specifics details I'm not remembering, but there is one class of user, the project manager, that has access to edit _everything_, and other than that, users are assigned to sources, and those users have permission to edit all chants within that source. I.e. I don't believe there should be any users who currently have access to edit any chant.

If we change who can see the view-edit toggle, this should not affect who has access to view the chant-edit page, it should just ensure that _only_ those with sufficient permissions to view the chant-edit page are shown the Edit link.
@jacobdgm are those permissions specifications available somewhere? now I'm curious about them.
@jwang44 do we have a record of this? I was also just thinking that this should be added to the documentation - I was thinking of doing this based on the current state of the code, but if you have this written down somewhere, I could ensure that we're following the spec at the same time.
I don’t have this written down, but you can just check whether a user has write access to the source before rendering the template.
________________________________
From: Jacob deGroot-Maggetti ***@***.***>
Sent: Friday, December 2, 2022 3:57:57 PM
To: DDMAL/CantusDB ***@***.***>
Cc: Junhao Wang ***@***.***>; Mention ***@***.***>
Subject: Re: [DDMAL/CantusDB] Users should only be shown the View-Edit toggle if they have edit access for the chant in question (Issue #448)


@jwang44<https://github.com/jwang44> do we have a record of this? I was also just thinking that this should be added to the documentation - I was thinking of doing this based on the current state of the code, but if you have this written down somewhere, I could ensure that we're following the spec at the same time.

—
Reply to this email directly, view it on GitHub<https://github.com/DDMAL/CantusDB/issues/448#issuecomment-1335839119>, or unsubscribe<https://github.com/notifications/unsubscribe-auth/AM56D7H5MJO5CWUH57OYYLTWLJPFLANCNFSM6AAAAAASSDDVPU>.
You are receiving this because you were mentioned.Message ID: ***@***.***>

@jwang44 so basically there are:
-admins, who have write access to everything all the time, can proofread, can create users, and can assign editors to sources;
-editors, who can only edit chants (or source descriptions) in sources that they have been assigned to by an admin (not other editors) or created themselves, but can view everything in the database;
-the general public/non-editors, who can't edit anything and can only see published sources and chants from published sources.

Is that right? (I recognize that this discussion is veering away from the specific problem at hand, which is just about rendering the edit button for the right users...) 
The three use levels are (from low to high): contributors, editors, project managers. Privileges are implemented according to this spreadsheet. This is found in #160 
https://docs.google.com/spreadsheets/d/1v-9IwsR6JBWFDaHaJlEzfDvZzK7W3fl13kLldOdmu0I/edit#gid=1535637058
thanks @jwang44 ! this is what I wanted!
Reopening this issue, because the View-Edit toggle still appears for a main manuscript page, even though it also leads to a 403 error if the user doesn't have access.
<img width="1362" alt="Edit option for main page" src="https://github.com/DDMAL/CantusDB/assets/83373378/bb2c6ad8-8896-465a-9712-ed1f3a5ae630">

@JoyfulGen - good catch!

I should be able to track this down based on this source's siglum, but in the future, a URL would be helpful so that a developer can quickly zero in on the page in question to start fixing things.
this is more or less a duplicate of #775 
I'm going to set this aside for the immediate present, but some things discovered as I was investigating this (for the benefit of me/Lucas when we have a chance to fix this)

In the Source Detail template, when deciding whether to display "view-edit", we currently only check whether the user is logged in or not. This is the case for both the "view-edit" toggle, and the "source edit options" sidebar. This explains why links to 403-causing pages are being rendered.

On the Chant Detail template, we have a context variable, `user_can_edit_chants` that we compute in the view and use in an `if` tag in the template. We could do the same sort of thing in the Source Detail template, though we'd need two variables: something along the lines of `user_can_edit_chants_in_source` and `user_can_edit_source_description`. We'd display the "source edit options" sidebar only if `user_can_edit_chants_in_source`. We'd only display the toggle if `user_can_edit_source_description`, and we'd also show/hide the "edit source description" link in the sidebar based on the value of this variable.

Resolving patch:
diff --git a/django/cantusdb_project/main_app/views/sequence.py b/django/cantusdb_project/main_app/views/sequence.py
--- a/django/cantusdb_project/main_app/views/sequence.py
+++ b/django/cantusdb_project/main_app/views/sequence.py
@@ -6,6 +6,7 @@
 from django.contrib import messages
 from django.contrib.auth.mixins import UserPassesTestMixin
 from django.core.exceptions import PermissionDenied
+from main_app.views.chant import user_can_edit_chants_in_source
 
 
 class SequenceDetailView(DetailView):
@@ -20,6 +21,8 @@ class SequenceDetailView(DetailView):
     def get_context_data(self, **kwargs):
         sequence = self.get_object()
         source = sequence.source
+        user = self.request.user
+
         # if the sequence's source isn't published,
         # only logged-in users should be able to view the sequence's detail page
         if (
@@ -35,6 +38,7 @@ def get_context_data(self, **kwargs):
             .select_related("source")
             .order_by("siglum")
         )
+        context["user_can_edit_sequence"] = user_can_edit_chants_in_source(user, source)
         return context
 
 


Test patch: