Repository: apluslms/a-plus

Issue:
Improve access denied messages and 403 page
Improve access denied messages and make them somewhat more explanatory, and also improve the 403 page so it's not quite so aggressive towards would-be learners.
See [Juha's comment](https://github.com/apluslms/a-plus/pull/853#discussion_r692139980) on PR #853 
Improve access denied messages and 403 page
Fixes #858

# Description

**What?**

Improve access denied message and 403 page

**Why?**

To make it more clear why user may not access certain pages

**How?**

By adding new error texts and changing how the 403 page looks like so the user can more easily navigate a-plus in case they get to the 403 page.

Fixes #858 


# Testing

**Remember to add or update unit tests for new features and changes.**

* How to [test your changes in A-plus](https://github.com/apluslms/a-plus/tree/master/doc#running-tests-and-updating-translations)
* How to [test accessibility](https://wiki.aalto.fi/display/EDIT/How+to+check+the+accessibility+of+pull+requests)


**What type of test did you run?**

- [ ] Accessibility test using the [WAVE](https://wave.webaim.org/extension/) extension.
- [ ] Django unit tests.
- [ ] Selenium tests.
- [ ] Other test. *(Add a description below)*
- [x] Manual testing.

[ADD A DESCRIPTION ABOUT WHAT YOU TESTED MANUALLY]

**Did you test the changes in**

- [ ] Chrome
- [x] Firefox
- [ ] This pull request cannot be tested in the browser.

**Think of what is affected by these changes and could become broken**

# Translation

- [x] Did you modify or add new strings in the user interface? ([Read about how to create translation](https://github.com/apluslms/a-plus/tree/master/doc#running-tests-and-updating-translations))

# Programming style

- [ ] Did you follow our [style guides](https://apluslms.github.io/contribute/styleguides/)?
- [ ] Did you use Python type hinting in all functions that you added or edited? ([type hints](https://docs.python.org/3/library/typing.html) for function parameters and return values)

# Have you updated the README or other relevant documentation?

- [ ] documents inside the doc directory.
- [ ] README.md.
- [ ] Aplus Manual.
- [ ] Other documentation (mention below which documentation).

# Is it Done?

- [ ] Reviewer has finished the code review
- [ ] After the review, the developer has made changes accordingly
- [ ] Customer/Teacher has accepted the implementation of the feature

*Clean up your git commit history before submitting the pull request!*



Discussion:
See that the texts are more student friendly and less techy
* Update the template (remove "Gandalf")
* Check through _messages.html and the python code that produces the messages
* Check that texts are localized
I especially think that it's problematic that some pages just provide 403 Forbidden page without explaining why it's forbidden.
 e.g.
![image](https://user-images.githubusercontent.com/50318434/203323819-1b552937-ae21-4553-a552-5e5f72bf6cf2.png)

But I'd like to also point out that [the things mentioned by Juha originally](https://github.com/apluslms/a-plus/pull/853#discussion_r692139980) (which lead to the creation of this issue) included the following:

_As far as I can tell, the point of the message is that a page is not accessible, at least not now. That is, the message’s point is not what technical entity might be "denying" or "forbidding" something, so that can be left out entirely._

_Maybe something along these lines?_

_If the page is unavailable to all: “The page at this address is not available at this time. The course staff may choose to make it public later. Please also check that you are attempting to access the correct page.”_

_If the page is unavailable to external students: “Sorry! The page at this address is only available to students with an Aalto University user account. If you have an Aalto account, please make sure you use it to log in to A+.”_

_Also, I’m not sure Forbidden in big letters is how we want to prefix this message to would-be learners._


I agree that it would be valuable if the messages were more detailed and explained why the content is not available to the user. 


Resolving patch:
diff --git a/authorization/permissions.py b/authorization/permissions.py
--- a/authorization/permissions.py
+++ b/authorization/permissions.py
@@ -114,6 +114,7 @@ def has_permission(self, request, view):
         if access_mode == ACCESS.ANONYMOUS:
             return True
         if not request.user.is_authenticated:
+            self.error_msg(_('ACCESS_ERROR_ONLY_AUTHENTICATED'))
             return False
 
         if access_mode >= ACCESS.SUPERUSER:


Test patch:
diff --git a/selenium_test/test/locators.py b/selenium_test/test/locators.py
--- a/selenium_test/test/locators.py
+++ b/selenium_test/test/locators.py
@@ -1,7 +1,11 @@
 from selenium.webdriver.common.by import By
 
 class CommonLocators:
-    FORBIDDEN_PAGE = (By.XPATH, "//div[@class='page-header']/h1[contains(text(), '403 Forbidden')]")
+    FORBIDDEN_PAGE = (
+        By.XPATH,
+        "//div[@class='message'][contains(text(), "
+        "'Unfortunately you are not permitted to see this content')]"
+    )
     PERMISSION_DENIED_ACCESS_MODE = (
         By.XPATH,
         "//main[@id='content']//div[@class='message'][contains(text(), "
diff --git a/selenium_test/test/teacher_list_test.py b/selenium_test/test/teacher_list_test.py
--- a/selenium_test/test/teacher_list_test.py
+++ b/selenium_test/test/teacher_list_test.py
@@ -26,7 +26,7 @@ def __init__(
             query.append("end_date=" + end_date.isoformat())
         query.append("with_assistants=" + ("true" if with_assistants else "false"))
 
-        self.load("/accounts/teachers/?" + "&".join(query), (By.CSS_SELECTOR, '.page-header'))
+        self.load("/accounts/teachers/?" + "&".join(query), (By.CSS_SELECTOR, '.container-fluid'))
 
     def get_table_data(self) -> List[List[str]]:
         rows = self.getElements((By.CSS_SELECTOR, "table tbody tr"))