Repository: learningequality/kolibri

Issue:
Facility coach as a user type not apply
When creating a new user as a Facility coach, it does not apply its permissions and not seen all classes.

A) In Admin interface:

In Device --> Permission:     User type | Facility coach

In Facility ---> Users:            User type | Facility coach

In profile :  Coach
-----------------------------------
B) In Facility coach (does not see any classes except if he is assigned by admin as a regular Coach)

In profile :   User type | Coach


<!--
Instructions:
 * Fill out the sections below, replace …'s with information about your issue
 * Use the 'preview' function above this text box to verify formatting before submitting
-->

## Observed behavior
<!--
Description of the behavior that was observed, including screenshots or other references when applicable
-->

…

## Errors and logs
<!--
Relevant logs from:
 * the command line
 * ~/.kolibri/logs/kolibri.txt
 * the browser console

Please wrap errors in triple backticks for clean formatting like this:
```
01:10 info: something happened
01:12 error: something bad happened
```
-->

…

## Expected behavior
<!--
Description of what behavior was expected but did not occur
-->

…

## User-facing consequences
<!--
Implications and real-world consequences for learners, coaches, admins, and other users of the application
-->

…

## Steps to reproduce
<!--
Precise steps that someone else can follow in order to see this behavior
-->

…

## Context
<!--
Tell us about your environment, including:
 * Kolibri version
 * Operating system
 * Browser
-->

…



Discussion:
What version of Kolibri is this happening on? I am not able to replicate this on 0.14.7.

Do you have any additional information to help us reproduce this?
the version is  0.15.0.dev0+git.20210429235644 

when i sign in with Facility coach account, i only view this but no classes that i was created:

Classes
View learner progress and class performance
Please consult your kolibri administrator 

Thanks, have replicated on develop.

Resolving patch:
diff --git a/kolibri/core/auth/api.py b/kolibri/core/auth/api.py
--- a/kolibri/core/auth/api.py
+++ b/kolibri/core/auth/api.py
@@ -425,6 +425,9 @@ def filter_has_role_for(self, queryset, name, value):
         if requesting_user.is_superuser:
             return queryset
 
+        if requesting_user.is_anonymous():
+            return queryset.none()
+
         # filter queryset by admin role and coach role
         roles = requesting_user.roles.exclude(kind=role_kinds.ASSIGNABLE_COACH)
 
@@ -436,7 +439,10 @@ def filter_has_role_for(self, queryset, name, value):
         if value == role_kinds.COACH:
             roles = roles.filter(kind=value)
 
-        return queryset.filter(id__in=roles.values("collection_id"))
+        return queryset.filter(
+            Q(id__in=roles.values("collection_id"))
+            | Q(parent_id__in=roles.values("collection_id"))
+        )
 
     class Meta:
         model = Classroom


Test patch:
diff --git a/kolibri/core/auth/test/test_api.py b/kolibri/core/auth/test/test_api.py
--- a/kolibri/core/auth/test/test_api.py
+++ b/kolibri/core/auth/test/test_api.py
@@ -296,6 +296,17 @@ def test_classroom_detail_assigned_coach_admin(self):
         }
         self.assertDictEqual(response.data, expected)
 
+    def test_classroom_facility_coach_role_for_filter(self):
+        coach = FacilityUserFactory.create(facility=self.facility)
+        self.facility.add_coach(coach)
+        response = self.client.get(
+            reverse("kolibri:core:classroom-list"),
+            data={"role": "coach"},
+            format="json",
+        )
+        # Should return all classrooms
+        self.assertEqual(len(response.data), len(self.classrooms))
+
     def test_cannot_create_classroom_same_name(self):
         classroom_name = self.classrooms[0].name
         response = self.client.post(