tangentlabs/django-oscar — pull request #732 by maikhoepfel (2013-06-21 12:02:59+00:00)
Title: Permission-based dashboard

This PR introduces the capability to control dashboard access based on permissions, and adds appropriate logic for the dashboard catalogue views. The dashboard navigation is now dynamically filtered on the user's permissions.

As long as the newly introduced `partner.dashboard_access` permission isn't assigned, behaviour should be unchanged. If it is set, this allows access to "unlocked" dashboard views, which currently only are the dashboard catalogue views. This allows basic support for the often-requested dashboard for multiple users.

The three views involved have been updated for non-staff users that have the `dashboard_access` permission:
* `ProductList` The user will only see her own products.
* `ProductDelete` The user will only be able to delete her own products, and only if carrying the `catalogue.delete_product` permission.
* `ProductCreateUpdate` The user is only able to create a product when `catalogue.add_product` is given. The user is only able to update a product when `catalogue.change_product` is given. In both cases, setting a stock record with a valid partner is enforced.

A valid partner is a partner that has the user in it's list of users - this determines what products a user can access.

--

I'm pretty happy with it code-wise, but would like feedback on my assumptions. Is this useful? For me, it would solve the "partners dashboard"/"multi-user dashboard" problem nicely.

Remaining todo:
[ ] Documentation
[ ] More tests for non-staff users
[ ] Update order views as well