Merge pull request #765 from euphorie/maurits-inspect-session

Support inspecting sessions

src/euphorie/client/browser/module.py

@@ -104,9 +104,9 @@ def integrated_action_plan(self):
         return self.webhelpers.integrated_action_plan
 
     def __call__(self):
-        # Render the page only if the user has edit rights,
+        # Render the page only if the user has inspection rights,
         # otherwise redirect to the start page of the session.
-        if not self.webhelpers.can_edit_session:
+        if not self.webhelpers.can_inspect_session:
             return self.request.response.redirect(
                 self.context.aq_parent.absolute_url() + "/@@start"
             )
@@ -156,7 +156,7 @@ def save_and_continue(self, module):
         # In Safari browser we get a list
         if isinstance(_next, list):
             _next = _next.pop()
-        if module.optional:
+        if module.optional and self.webhelpers.can_edit_session:
             if "skip_children" in reply:
                 context.skip_children = reply.get("skip_children")
                 context.postponed = False
@@ -172,23 +172,22 @@ def save_and_continue(self, module):
                 return
             self.request.response.redirect(self.previous_question_url)
             return
-        else:
-            if ICustomRisksModule.providedBy(module):
-                if _next == "add_custom_risk":
-                    self.add_custom_risk()
-                    notify(CustomRisksModifiedEvent(self.context))
-                    risk_id = self.context.children().count()
-                    url = "{parent_url}/{risk_id}/@@identification".format(
-                        parent_url=self.context.absolute_url(),
-                        risk_id=risk_id,
-                    )
-                    return self.request.response.redirect(url)
-                else:
-                    # We ran out of questions, proceed to the action plan
-                    return self.request.response.redirect(self.next_phase_url)
-            if self.next_question is None:
-                # We ran out of questions, proceed to the action plan
-                return self.request.response.redirect(self.next_phase_url)
+
+        if ICustomRisksModule.providedBy(module):
+            if _next == "add_custom_risk" and self.webhelpers.can_edit_session:
+                self.add_custom_risk()
+                notify(CustomRisksModifiedEvent(self.context))
+                risk_id = self.context.children().count()
+                url = "{parent_url}/{risk_id}/@@identification".format(
+                    parent_url=self.context.absolute_url(),
+                    risk_id=risk_id,
+                )
+                return self.request.response.redirect(url)
+            # We ran out of questions, proceed to the action plan
+            return self.request.response.redirect(self.next_phase_url)
+        if self.next_question is None:
+            # We ran out of questions, proceed to the action plan
+            return self.request.response.redirect(self.next_phase_url)
 
         self.request.response.redirect(self.next_question_url)
 

src/euphorie/client/browser/risk.py

@@ -509,9 +509,9 @@ def action_plan_condition(self):
         return condition
 
     def __call__(self):
-        # Render the page only if the user has edit rights,
+        # Render the page only if the user has inspection rights,
         # otherwise redirect to the start page of the session.
-        if not self.webhelpers.can_edit_session:
+        if not self.webhelpers.can_inspect_session:
             return self.request.response.redirect(
                 self.context.aq_parent.absolute_url() + "/@@start"
             )
@@ -523,6 +523,8 @@ def __call__(self):
 
         if self.request.method == "POST":
             reply = self.request.form
+            if not self.webhelpers.can_edit_session:
+                return self.proceed_to_next(reply)
             _next = self._get_next(reply)
             # Don't persist anything if the user skipped the question
             if _next == "skip":
@@ -594,9 +596,9 @@ def title(self):
         return self.session.title
 
     def check_render_condition(self):
-        # Render the page only if the user has edit rights,
+        # Render the page only if the user can inspection rights,
         # otherwise redirect to the start page of the session.
-        if not self.webhelpers.can_edit_session:
+        if not self.webhelpers.can_inspect_session:
             return self.request.response.redirect(
                 "{session_url}/@@start".format(
                     session_url=self.webhelpers.traversed_session.absolute_url()
@@ -1014,7 +1016,7 @@ def proceed_to_next(self, reply):
                 url = f"{base_url}/{next_view_name}"
                 return self.request.response.redirect(url)
 
-        elif _next == "add_custom_risk":
+        elif _next == "add_custom_risk" and self.webhelpers.can_edit_session:
             sql_module = (
                 Session.query(model.Module)
                 .filter(
@@ -1301,9 +1303,9 @@ def number_images(self):
 
     def __call__(self):
         super().__call__()
-        # Render the page only if the user has edit rights,
+        # Render the page only if the user has inspection rights,
         # otherwise redirect to the start page of the session.
-        if not self.webhelpers.can_edit_session:
+        if not self.webhelpers.can_inspect_session:
             return self.request.response.redirect(
                 "{session_url}/@@start".format(
                     session_url=self.webhelpers.traversed_session.absolute_url()
@@ -1358,16 +1360,17 @@ def __call__(self):
 
         if self.request.method == "POST":
             reply = self.request.form
-            session = Session()
-            context.comment = self.webhelpers.get_safe_html(reply.get("comment"))
-            context.priority = reply.get("priority")
-
-            new_plans, changes = self.extract_plans_from_request()
-            for plan in context.standard_measures + context.custom_measures:
-                session.delete(plan)
-            context.action_plans.extend(new_plans)
-            if changes:
-                self.session.touch()
+            if self.webhelpers.can_edit_session:
+                session = Session()
+                context.comment = self.webhelpers.get_safe_html(reply.get("comment"))
+                context.priority = reply.get("priority")
+
+                new_plans, changes = self.extract_plans_from_request()
+                for plan in context.standard_measures + context.custom_measures:
+                    session.delete(plan)
+                context.action_plans.extend(new_plans)
+                if changes:
+                    self.session.touch()
 
             _next = self._get_next(reply)
             if _next == "previous":

src/euphorie/client/browser/session.py

@@ -611,7 +611,8 @@ def extra_text(self):
         )
 
     def __call__(self):
-        if not self.webhelpers.can_edit_session:
+        self.verify_view_permission()
+        if not self.webhelpers.can_inspect_session:
             return self.request.response.redirect(
                 self.context.absolute_url() + "/@@start"
             )
@@ -878,7 +879,7 @@ def skip_intro(self):
     def __call__(self):
         """Render the page only if the user has edit rights, otherwise redirect
         to the start page of the session."""
-        if not self.webhelpers.can_edit_session:
+        if not self.webhelpers.can_inspect_session:
             return self.request.response.redirect(
                 self.context.absolute_url() + "/@@start"
             )

src/euphorie/client/browser/templates/module_identification_custom.pt

@@ -27,7 +27,9 @@
           <tal:block replace="tile:statusmessages" />
           <h1 i18n:translate="label_custom_risks">Custom risks</h1>
 
-          <p tal:content="structure module/description">
+          <p tal:condition="webhelpers/can_edit_session"
+             tal:content="structure module/description"
+          >
             Sed ut perspiciatis unde omnis iste natus error sit voluptatem
             accusantium doloremque laudantium, totam rem aperiam, eaque ipsa quae
             ab illo inventore veritatis et quasi architecto beatae vitae dicta sunt
@@ -37,9 +39,11 @@
                 action="${context/absolute_url}/@@identification"
                 method="post"
                 data-pat-inject="history: record; source: #content; target: #content; &amp;&amp; source: #other-risks; target: #other-risks"
+                tal:condition="webhelpers/can_edit_session"
           >
             <p>
               <button class="pat-button default"
+                      disabled="${python:'disabled' if not webhelpers.can_edit_session else None}"
                       name="next"
                       type="submit"
                       value="add_custom_risk"

src/euphorie/client/browser/templates/risk_actionplan.pt

@@ -70,7 +70,8 @@
               <tal:priority tal:define="
                               show_statement python:True;
                             ">
-                <fieldset tal:define="
+                <fieldset disabled="${python:'disabled' if not webhelpers.can_edit_session else None}"
+                          tal:define="
                             value context/priority;
                             readonly python:context.risk_type in ['top5'];
                             skip_evaluation view/skip_evaluation;
@@ -160,8 +161,16 @@
                     name="next"
                     type="submit"
                     value="next"
-                    i18n:translate="label_save_and_continue"
-            >Save and continue</button>
+            >
+              <tal:save condition="webhelpers/can_edit_session"
+                        i18n:translate="label_save_and_continue"
+              >Save and continue
+              </tal:save>
+              <tal:continue condition="not:webhelpers/can_edit_session"
+                            i18n:translate="label_next"
+              >Next
+              </tal:continue>
+            </button>
           </p>
         </form>
       </tal:def>

src/euphorie/client/browser/templates/risk_identification.pt

@@ -120,12 +120,14 @@
                   name="next"
                   type="submit"
                   value="next"
+                  tal:condition="webhelpers/can_edit_session"
                   i18n:translate="label_save_and_continue"
           >Save and continue</button>
           <button class="pat-button continue"
                   name="save"
                   type="submit"
                   value="save"
+                  tal:condition="webhelpers/can_edit_session"
                   i18n:translate=""
           >Save</button>
           <button class="pat-button skip"

src/euphorie/client/browser/templates/risk_identification_custom.pt

@@ -34,6 +34,7 @@
             <metal:actions fill-slot="page-actions">
               <div class="toolbar-section quick-functions"
                    id="assessment-toolbar-quick-functions"
+                   tal:condition="webhelpers/can_edit_session"
               >
                 <a class="icon icon-trash pat-modal"
                    href="${context/absolute_url}/@@confirmation-delete-risk#document-content"
@@ -48,6 +49,7 @@
 
 
           <fieldset class="content-mirror risk-title pat-inject pat-autosubmit pat-subform"
+                    disabled="${python:'disabled' if not webhelpers.can_edit_session else None}"
                     data-pat-autosubmit="1000ms"
                     data-pat-inject="source: #steps; target: #steps ${python:'&amp;&amp; source: #evaluation; target: #evaluation' if not view.skip_evaluation else None} ${python:'&amp;&amp; source: #slide-content-1; target: #slide-content-1' if webhelpers.use_training_module else None}"
           >
@@ -70,6 +72,7 @@
           <tal:existing-measures condition="view/use_existing_measures">
             <fieldset class="add-measure-in-place-other pat-checklist measures-in-place pat-clone pat-inject pat-subform"
                       id="add-measure-in-place"
+                      disabled="${python:'disabled' if not webhelpers.can_edit_session else None}"
                       data-pat-autosubmit="1000ms"
                       data-pat-clone="template: #in-place-measure-template; trigger-element: #add-in-place-measure-button;  remove-confirmation: Are you sure you want to remove this existing measure?"
                       data-pat-inject="source: #add-measure-in-place; target: #add-measure-in-place ${python:webhelpers.use_training_module and '&amp;&amp; source: #slide-preview-existing-measures; target: #slide-preview-existing-measures' or None}"
@@ -153,7 +156,9 @@
           </tal:existing-measures>
 
 
-          <fieldset class="pat-checklist radio pat-rich">
+          <fieldset class="pat-checklist radio pat-rich"
+                    disabled="${python:'disabled' if not webhelpers.can_edit_session else None}"
+          >
             <legend>
               <tal:intro content="structure view/intro_questions" />
             </legend>
@@ -200,6 +205,7 @@
           >
             <p class="problem-description"><strong>${here/title}</strong></p>
             <fieldset class="pat-checklist radio"
+                      disabled="${python:'disabled' if not webhelpers.can_edit_session else None}"
                       tal:define="
                         value context/priority;
                       "
@@ -237,7 +243,9 @@
         Information
             </h3>
             <div class="panel-content">
-              <fieldset class="vertical row">
+              <fieldset class="vertical row"
+                        disabled="${python:'disabled' if not webhelpers.can_edit_session else None}"
+              >
                 <div class="eight columns">
 
                   <div class="pat-rich-editor pat-rich toolbar-detached">
@@ -314,26 +322,38 @@
                   value="previous"
                   i18n:translate="label_previous"
           >Previous</button>
-          <button class="pat-button continue"
-                  name="next"
-                  type="submit"
-                  value="add_custom_risk"
-                  tal:condition="not:view/has_next_risk"
-                  i18n:translate="label_save_and_add_new"
-          >Save and add new risk</button>
-          <button class="pat-button continue"
-                  name="next"
-                  type="submit"
-                  value="next"
-                  tal:condition="view/has_next_risk"
-                  i18n:translate="label_save_and_continue"
-          >Save and continue</button>
-          <button class="pat-button float-after"
-                  name="next"
-                  type="submit"
-                  value="actionplan"
-                  i18n:translate="label_save_and_finish"
-          >Save and finish</button>
+          <tal:can-edit condition="webhelpers/can_edit_session">
+            <button class="pat-button continue"
+                    name="next"
+                    type="submit"
+                    value="add_custom_risk"
+                    tal:condition="not:view/has_next_risk"
+                    i18n:translate="label_save_and_add_new"
+            >Save and add new risk</button>
+            <button class="pat-button continue"
+                    name="next"
+                    type="submit"
+                    value="next"
+                    tal:condition="view/has_next_risk"
+                    i18n:translate="label_save_and_continue"
+            >Save and continue</button>
+            <button class="pat-button float-after"
+                    name="next"
+                    type="submit"
+                    value="actionplan"
+                    i18n:translate="label_save_and_finish"
+            >Save and finish</button>
+          </tal:can-edit>
+          <tal:cannot-edit condition="not:webhelpers/can_edit_session">
+            <button class="pat-button continue"
+                    name="next"
+                    type="submit"
+                    value="next"
+                    i18n:translate="label_next"
+            >Next</button>
+
+          </tal:cannot-edit>
+
         </p>
 
       </form>