manager: need to be staff to duplicate an agenda (#81583)

chrono/manager/templates/chrono/manager_agenda_settings.html

@@ -21,7 +21,9 @@
     <ul class="extra-actions-menu">
       <li><a rel="popup" href="{% url 'chrono-manager-agenda-edit' pk=object.id %}">{% trans 'Options' %}</a></li>
       {% block agenda-extra-menu-actions %}{% endblock %}
-      <li><a rel="popup" class="action-duplicate" href="{% url 'chrono-manager-agenda-duplicate' pk=object.pk %}">{% trans 'Duplicate' %}</a></li>
+      {% if user.is_staff %}
+        <li><a rel="popup" class="action-duplicate" href="{% url 'chrono-manager-agenda-duplicate' pk=object.pk %}">{% trans 'Duplicate' %}</a></li>
+      {% endif %}
       <li><a download href="{% url 'chrono-manager-agenda-export' pk=object.id %}">{% trans 'Export Configuration (JSON)' %}</a></li>
       {% if object.kind == 'events' %}
         <li><a download href="{% url 'chrono-manager-agenda-export-events' pk=object.pk %}">{% trans 'Export Events (CSV)' %}</a></li>

chrono/manager/views.py

@@ -2269,10 +2269,16 @@ class AgendaExport(ManagedAgendaMixin, DetailView):
 agenda_export = AgendaExport.as_view()
 
 
-class AgendaDuplicate(ManagedAgendaMixin, FormView):
+class AgendaDuplicate(FormView):
     form_class = AgendaDuplicateForm
     template_name = 'chrono/manager_agenda_duplicate_form.html'
 
+    def dispatch(self, request, *args, **kwargs):
+        self.agenda = get_object_or_404(Agenda, pk=kwargs.get('pk'))
+        if not request.user.is_staff:
+            raise PermissionDenied()
+        return super().dispatch(request, *args, **kwargs)
+
     def get_success_url(self):
         return reverse('chrono-manager-agenda-settings', kwargs={'pk': self.new_agenda.pk})
 
@@ -2283,6 +2289,11 @@ class AgendaDuplicate(ManagedAgendaMixin, FormView):
         self.new_agenda = self.agenda.duplicate(label=form.cleaned_data['label'])
         return super().form_valid(form)
 
+    def get_context_data(self, **kwargs):
+        context = super().get_context_data(**kwargs)
+        context['agenda'] = self.agenda
+        return context
+
 
 agenda_duplicate = AgendaDuplicate.as_view()
 

tests/manager/test_all.py

@@ -3243,6 +3243,16 @@ def test_duplicate_agenda(app, admin_user):
     assert 'hop' in resp.text
 
 
+def test_duplicate_agenda_as_manager(app, manager_user):
+    agenda = Agenda(label='Foo bar')
+    agenda.edit_role = manager_user.groups.all()[0]
+    agenda.save()
+    app = login(app, username='manager', password='manager')
+    resp = app.get('/manage/agendas/%s/settings' % agenda.pk)
+    assert '/manage/agendas/%s/duplicate' % agenda.pk not in resp
+    app.get('/manage/agendas/%s/duplicate' % agenda.pk, status=403)
+
+
 def test_booking_cancellation_meetings_agenda(app, admin_user, manager_user, managers_group, api_user):
     agenda = Agenda.objects.create(label='Passeports', kind='meetings', view_role=managers_group)
     desk = Desk.objects.create(agenda=agenda, label='Desk A')