Issue #31 added permissions to the worker views

smash/web/views/worker.py

@@ -10,6 +10,7 @@ from web.models.constants import WEEKDAY_CHOICES, GLOBAL_STUDY_ID, AVAILABILITY_
 from web.models.worker import worker_type_by_worker
 from web.models.worker_study_role import WORKER_STAFF
 from . import wrap_response
+from web.decorators import PermissionDecorator
 
 logger = logging.getLogger(__name__)
 
@@ -23,7 +24,7 @@ def worker_list(request, worker_type=WORKER_STAFF):
 
     return wrap_response(request, "doctors/index.html", context)
 
-
+@PermissionDecorator('add_worker')
 def worker_add(request, worker_type):
     if request.method == 'POST':
         form = WorkerForm(request.POST, request.FILES, worker_type=worker_type)
@@ -35,7 +36,7 @@ def worker_add(request, worker_type):
 
     return wrap_response(request, 'doctors/add.html', {'form': form, "worker_type": worker_type})
 
-
+@PermissionDecorator('change_worker')
 def worker_edit(request, worker_id):
     worker = get_object_or_404(Worker, id=worker_id)
     worker_type = worker_type_by_worker(worker)
@@ -59,20 +60,20 @@ def worker_edit(request, worker_id):
                              "worker_type": worker_type
                          })
 
-
+@PermissionDecorator('delete_worker')
 def worker_disable(request, doctor_id):
     the_doctor = get_object_or_404(Worker, id=doctor_id)
     the_doctor.disable()
     return worker_list(request)
 
-
+@PermissionDecorator('change_worker')
 def worker_availability_delete(request, availability_id):
     availability = Availability.objects.filter(id=availability_id)
     doctor_id = availability[0].person.id
     availability.delete()
     return redirect(worker_edit, worker_id=doctor_id)
 
-
+@PermissionDecorator('change_worker')
 def worker_availability_add(request, doctor_id):
     worker = get_object_or_404(Worker, id=doctor_id)
     if request.method == 'POST':
@@ -89,7 +90,7 @@ def worker_availability_add(request, doctor_id):
                              'doctor_name': unicode(worker)
                          })
 
-
+@PermissionDecorator('change_worker')
 def worker_availability_edit(request, availability_id):
     availability = get_object_or_404(Availability, id=availability_id)
     if request.method == 'POST':
@@ -106,14 +107,14 @@ def worker_availability_edit(request, availability_id):
                              'doctor_id': availability.person_id,
                          })
 
-
+@PermissionDecorator('change_worker')
 def worker_holiday_delete(request, holiday_id):
     holiday = Holiday.objects.filter(id=holiday_id)
     doctor_id = holiday[0].person.id
     holiday.delete()
     return redirect(worker_edit, worker_id=doctor_id)
 
-
+@PermissionDecorator('change_worker')
 def worker_holiday_add(request, doctor_id):
     doctors = Worker.objects.filter(id=doctor_id)
     doctor = None