Repository: carpentries/amy

Issue:
Steering Committee members aren't allowed into AMY
All access apart from AutoUpdateProfile is allowed only for admins, and people from Steering Committee have "steering committee" group which is not considered admin.

The workaround for now is that I'll add SC members to the "administrators" group.



Discussion:
@pbanaszkiewicz, so do you want to change `@admin_required` so that it checks if a user belongs to `administator` group or `steering committee` group?

@chrismedrela the `@admin_required` should be extended to cover "steering committee" group as well.


Resolving patch:
diff --git a/workshops/models.py b/workshops/models.py
--- a/workshops/models.py
+++ b/workshops/models.py
@@ -422,7 +422,8 @@ def is_admin(user):
         return False
     else:
         return (user.is_superuser or
-                user.groups.filter(name='administrators').exists())
+                user.groups.filter(Q(name='administrators') |
+                                   Q(name='steering committee')).exists())
 
 
 class ProfileUpdateRequest(ActiveMixin, CreatedUpdatedMixin, models.Model):


Test patch:
diff --git a/workshops/test/test_security.py b/workshops/test/test_security.py
--- a/workshops/test/test_security.py
+++ b/workshops/test/test_security.py
@@ -38,24 +38,34 @@ def setUp(self):
         super().setUp()
 
         admins = Group.objects.get(name='administrators')
+        steering_committee = Group.objects.get(name='steering committee')
 
-        # superuser who doesn't belong to Admin group
+        # superuser who doesn't belong to Admin group should have access to
+        # admin dashboard
         self.admin = Person.objects.create_superuser(
             username='superuser', personal='Super', family='User',
             email='superuser@example.org', password='superuser')
         assert admins not in self.admin.groups.all()
 
-        # user with access to admin dashboard
+        # user belonging to Admin group should have access to admin dashboard
         self.mentor = Person.objects.create_user(
             username='admin', personal='Bob', family='Admin',
             email='admin@example.org', password='admin')
         self.mentor.groups.add(admins)
 
+        # steering committee members should have access to admin dashboard too
+        self.committee = Person.objects.create_user(
+            username='committee', personal='Bob', family='Committee',
+            email='committee@example.org', password='committee',
+        )
+        self.committee.groups.add(steering_committee)
+
         # user with access only to trainee dashboard
         self.trainee = Person.objects.create_user(
             username='trainee', personal='Bob', family='Trainee',
             email='trainee@example.org', password='trainee')
         assert admins not in self.trainee.groups.all()
+        assert steering_committee not in self.trainee.groups.all()
 
     def assert_accessible(self, url, user=None):
         if user:
@@ -87,6 +97,7 @@ def test_function_based_view_restricted_to_admins(self):
 
         self.assert_accessible(url, user='superuser')
         self.assert_accessible(url, user='admin')
+        self.assert_accessible(url, user='committee')
         self.assert_inaccessible(url, user='trainee')
         self.assert_inaccessible(url, user=None)
 
@@ -102,6 +113,7 @@ def test_function_based_view_restricted_to_authorized_users(self):
 
         self.assert_accessible(url, user='superuser')
         self.assert_accessible(url, user='admin')
+        self.assert_accessible(url, user='committee')
         self.assert_accessible(url, user='trainee')
         self.assert_inaccessible(url, user=None)
 
@@ -117,6 +129,7 @@ def test_function_based_view_accessible_to_unauthorized_users(self):
 
         self.assert_accessible(url, user='superuser')
         self.assert_accessible(url, user='admin')
+        self.assert_accessible(url, user='committee')
         self.assert_accessible(url, user='trainee')
         self.assert_accessible(url, user=None)
 
@@ -131,6 +144,7 @@ def test_class_based_view_restricted_to_admins(self):
 
         self.assert_accessible(url, user='superuser')
         self.assert_accessible(url, user='admin')
+        self.assert_accessible(url, user='committee')
         self.assert_inaccessible(url, user='trainee')
         self.assert_inaccessible(url, user=None)
 
@@ -145,6 +159,7 @@ def test_class_based_view_accessible_to_unauthorized_users(self):
 
         self.assert_accessible(url, user='superuser')
         self.assert_accessible(url, user='admin')
+        self.assert_accessible(url, user='committee')
         self.assert_accessible(url, user='trainee')
         self.assert_accessible(url, user=None)