From b89f09105c9c1724a8ea51f5c6eaa99cce2943d4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?V=C3=AD=C3=B0ir=20Valberg=20Gu=C3=B0mundsson?=
 <valberg@orn.li>
Date: Wed, 31 Jul 2019 21:14:17 +0200
Subject: [PATCH] Make team guide only visible for approved members. Fix #369.

---
 src/teams/templates/team_base.html |  3 +++
 src/teams/views/guide.py           | 22 ++++++++++++++--------
 2 files changed, 17 insertions(+), 8 deletions(-)

diff --git a/src/teams/templates/team_base.html b/src/teams/templates/team_base.html
index bcd861e8..44dee5c4 100644
--- a/src/teams/templates/team_base.html
+++ b/src/teams/templates/team_base.html
@@ -53,11 +53,14 @@ Team: {{ team.name }} | {{ block.super }}
         </li>
         {% endif %}
 
+        {% if request.user in team.members.all %}
         <li {% if view.active_menu == "guide" %}class="active"{% endif %}>
             <a href="{% url "teams:guide" camp_slug=team.camp.slug team_slug=team.slug %}">
                 Team guide
             </a>
         </li>
+        {% endif %}
+
 
     </ul>
 
diff --git a/src/teams/views/guide.py b/src/teams/views/guide.py
index 0bcc8a2a..9b1f0727 100644
--- a/src/teams/views/guide.py
+++ b/src/teams/views/guide.py
@@ -1,22 +1,28 @@
-from django.contrib.auth.mixins import LoginRequiredMixin
-from django.views.generic import ListView, DetailView
+from django.views.generic import DetailView
 
 from camps.mixins import CampViewMixin
+from django.contrib.auth.mixins import UserPassesTestMixin, LoginRequiredMixin
 
-from ..models import Team
+from ..models import Team, TeamMember
 
 
-class TeamGuideView(LoginRequiredMixin, CampViewMixin, DetailView):
+class TeamGuideView(LoginRequiredMixin, CampViewMixin, UserPassesTestMixin, DetailView):
     template_name = "team_guide.html"
     context_object_name = "team"
     model = Team
     slug_url_kwarg = "team_slug"
     active_menu = "guide"
 
-    def get_queryset(self):
-        qs = CampViewMixin.get_queryset(self)
-        qs.filter(teammember__approved=True, teammember__user=self.request.user)
-        return qs
+    def test_func(self):
+        # Make sure that the user is an approved member of the team
+        try:
+            TeamMember.objects.get(
+                user=self.request.user, team=self.get_object(), approved=True
+            )
+        except TeamMember.DoesNotExist:
+            return False
+        else:
+            return True
 
 
 class TeamGuidePrintView(TeamGuideView):