Repository: akvo/akvo-rsr

Issue:
User permissions for adding a new organisation
Currently organisation Admins and Project Editors do not have the right to add a new organisation. Since they are adding / editing projects, it should be possible for them to add organisations to RSR that do not exist yet. However, we should make sure that all organisation names stay unique (see https://github.com/akvo/akvo-rsr/issues/1406)
## Test plan

GIVEN the organisation admin
WHEN logged in as Organisation Admin or Project Editor
THEN it should be possible to add a new organisation

GIVEN the organisation admin
WHEN logged in as Organisation Admin or Project Editor
THEN it should be possible to edit a new organisation when you are connected to this organisation
OR when the organisation is part of a project that (one of) your organisations is linked to as well



Discussion:

Resolving patch:
diff --git a/akvo/rsr/models/__init__.py b/akvo/rsr/models/__init__.py
--- a/akvo/rsr/models/__init__.py
+++ b/akvo/rsr/models/__init__.py
@@ -245,8 +245,9 @@
 rules.add_perm('rsr.change_projectdocument', is_rsr_admin | is_org_admin | is_org_project_editor)
 rules.add_perm('rsr.delete_projectdocument', is_rsr_admin | is_org_admin | is_org_project_editor)
 
-rules.add_perm('rsr.add_organisation', is_rsr_admin)
-rules.add_perm('rsr.change_organisation', is_rsr_admin | is_org_admin)
+rules.add_perm('rsr.add_organisation', is_rsr_admin | is_org_admin | is_org_project_editor)
+rules.add_perm('rsr.change_organisation', is_rsr_admin | is_org_admin | is_org_project_editor)
+rules.add_perm('rsr.delete_organisation', is_rsr_admin)
 
 rules.add_perm('rsr.add_organisationlocation', is_rsr_admin | is_org_admin)
 rules.add_perm('rsr.change_organisationlocation', is_rsr_admin | is_org_admin)
diff --git a/akvo/rsr/permissions.py b/akvo/rsr/permissions.py
--- a/akvo/rsr/permissions.py
+++ b/akvo/rsr/permissions.py
@@ -26,8 +26,11 @@ def is_org_admin(user, obj):
         if employment.group == Group.objects.get(name='Admins'):
             if not obj:
                 return True
-            if isinstance(obj, Organisation) and obj == employment.organisation:
-                return True
+            elif isinstance(obj, Organisation):
+                if obj == employment.organisation:
+                    return True
+                elif obj in employment.organisation.partners():
+                    return True
             elif isinstance(obj, get_user_model()) and obj in employment.organisation.all_users():
                 return True
             elif isinstance(obj, Employment) and obj in employment.organisation.employees.all():
@@ -84,6 +87,11 @@ def is_org_project_editor(user, obj):
         if employment.group == Group.objects.get(name='Project Editors'):
             if not obj:
                 return True
+            elif isinstance(obj, Organisation):
+                if obj == employment.organisation:
+                    return True
+                elif obj in employment.organisation.partners():
+                    return True
             elif isinstance(obj, Project) and obj in employment.organisation.all_projects():
                 return True
             else:


Test patch: