view_statistics permission implemented

smash/web/migrations/0143_auto_20200319_1446.py

+# -*- coding: utf-8 -*-
+# Generated by Django 1.11.5 on 2020-03-19 14:46
+from __future__ import unicode_literals
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('web', '0142_auto_20200319_1415'),
+    ]
+
+    operations = [
+        migrations.AlterModelOptions(
+            name='appointment',
+            options={'permissions': [('send_sample_mail_for_appointments', 'Can send sample collection list'), ('view_statistics', 'Can see statistics')]},
+        ),
+    ]

smash/web/models/appointment.py

@@ -13,6 +13,7 @@ class Appointment(models.Model):
         app_label = 'web'
         permissions = [
             ("send_sample_mail_for_appointments", "Can send sample collection list"),
+            ("view_statistics", "Can see statistics"),
         ]
 
     APPOINTMENT_STATUS_SCHEDULED = 'SCHEDULED'

smash/web/templates/sidebar.html

@@ -64,12 +64,14 @@
         </li>
     {% endif %}
 
-    <li data-desc="statistics">
-        <a href="{% url 'web.views.statistics' %}">
-            <i class="fa fa-bar-chart" aria-hidden="true"></i>
-            <span>Statistics</span>
-        </a>
-    </li>
+    {% if  "view_statistics" in permissions %}
+        <li data-desc="statistics">
+            <a href="{% url 'web.views.statistics' %}">
+                <i class="fa fa-bar-chart" aria-hidden="true"></i>
+                <span>Statistics</span>
+            </a>
+        </li>
+    {% endif %}
 
     <li data-desc="mail_templates">
         <a href="{% url 'web.views.mail_templates' %}">

smash/web/tests/view/test_statistics.py

@@ -10,6 +10,7 @@ __author__ = 'Valentin Grouès'
 
 class TestStatisticsView(LoggedInTestCase):
     def test_statistics_request(self):
+        self.login_as_admin()
         url = reverse('web.views.statistics')
         response = self.client.get(url)
         self.assertEqual(response.status_code, 200)
@@ -19,3 +20,8 @@ class TestStatisticsView(LoggedInTestCase):
         response = self.client.get(url, {"month": 10, "year": 2017, "subject_type": -1, "visit": -1})
         content = response.content
         self.assertIn('<option value="10" selected>October', content)
+
+    def test_statistics_request_without_permission(self):
+        url = reverse('web.views.statistics')
+        response = self.client.get(url)
+        self.assertEqual(response.status_code, 302)

smash/web/views/statistics.py

 # coding=utf-8
+from web.decorators import PermissionDecorator
 from . import wrap_response
 from ..forms import StatisticsForm
 from ..statistics import StatisticsManager, get_previous_year_and_month
 
 
+@PermissionDecorator('view_statistics', 'appointment')
 def statistics(request):
     statistics_manager = StatisticsManager()
     visit_choices = [("-1", "all")]