Repository: akvo/akvo-rsr

Issue:
Edit and remove updates
Currently, when you've added a project update, there is an 'Edit' button on the update page itself for 20 minutes. However, it should always be possible to edit your own updates, so this time limit should be removed. In addition, it would be nice to have the 'Edit' button on the 'My updates' page in MyRSR as well.
- [x] Remove the 20 minutes limit for editing project updates.
- [x] Remove the 'Edit' button from the update page.
- [x] Add 'Edit' and 'Delete' action in My updates section of MyRSR.



Discussion:

Resolving patch:
diff --git a/akvo/rsr/models/project_update.py b/akvo/rsr/models/project_update.py
--- a/akvo/rsr/models/project_update.py
+++ b/akvo/rsr/models/project_update.py
@@ -82,26 +82,6 @@ def img(self, value=''):
             return value
     img.allow_tags = True
 
-    def edit_window_has_expired(self):
-        """Determine whether or not update timeout window has expired.
-        The timeout is controlled by settings.PROJECT_UPDATE_TIMEOUT and
-        defaults to 30 minutes.
-        """
-        return (datetime.now() - self.created_at) > self.edit_timeout
-
-    @property
-    def expires_at(self):
-        return to_gmt(self.created_at + self.edit_timeout)
-
-    @property
-    def edit_timeout(self):
-        timeout_minutes = getattr(settings, 'PROJECT_UPDATE_TIMEOUT', 30)
-        return timedelta(minutes=timeout_minutes)
-
-    @property
-    def edit_time_remaining(self):
-        return self.edit_timeout - self.created_at
-
     @property
     def time_gmt(self):
         return to_gmt(self.created_at)
diff --git a/akvo/rsr/views/my_rsr.py b/akvo/rsr/views/my_rsr.py
--- a/akvo/rsr/views/my_rsr.py
+++ b/akvo/rsr/views/my_rsr.py
@@ -244,7 +244,8 @@ def project_editor(request, project_id):
     except Project.DoesNotExist:
         return Http404
 
-    if not request.user.has_perm('rsr.change_project', project):
+    if (not request.user.has_perm('rsr.change_project', project) or project.status == 'C') and not \
+            (request.user.is_superuser or request.user.is_admin):
         raise PermissionDenied
 
     # Custom fields
@@ -480,7 +481,7 @@ def my_results(request, project_id):
     project = get_object_or_404(Project, pk=project_id)
     user = request.user
 
-    if not user.has_perm('rsr.change_project', project):
+    if not user.has_perm('rsr.change_project', project) or project.status == 'C' or not project.is_published():
         raise PermissionDenied
 
     me_managers_group = Group.objects.get(name='M&E Managers')
diff --git a/akvo/rsr/views/project.py b/akvo/rsr/views/project.py
--- a/akvo/rsr/views/project.py
+++ b/akvo/rsr/views/project.py
@@ -420,9 +420,10 @@ def set_update(request, project_id, edit_mode=False, form_class=ProjectUpdateFor
             request.error_message = u'You can only edit your own updates.'
             raise PermissionDenied
 
-        if update.edit_window_has_expired():
-            request.error_message = u'You cannot edit this update anymore, the 30 minutes time limit has passed.'
-            raise PermissionDenied
+    # Prevent adding update if project is completed or unpublished
+    elif project.status == 'C' or not project.is_published():
+        request.error_message = u'Cannot add updates to completed or unpublished projects.'
+        raise PermissionDenied
 
     if request.method == 'POST':
         updateform = form_class(request.POST, request.FILES, instance=update)


Test patch: