🧑‍💻 Add is_crew helper

froide/document/filters.py

@@ -11,7 +11,7 @@
 from froide.account.models import User
 from froide.campaign.models import Campaign
 from froide.foirequest.auth import get_read_foirequest_queryset
-from froide.helper.auth import get_read_queryset
+from froide.helper.auth import get_read_queryset, is_crew
 from froide.helper.search.filters import BaseSearchFilterSet
 from froide.helper.widgets import BootstrapSelect, DateRangeWidget
 from froide.publicbody.models import Jurisdiction, PublicBody
@@ -58,7 +58,7 @@ def filter_foirequest(self, qs, name, value):
 
 
 def get_portal_queryset(request):
-    if not request.user.is_authenticated or not request.user.is_crew:
+    if is_crew(request.user):
         return DocumentPortal.objects.filter(public=True)
     return DocumentPortal.objects.all()
 

froide/foirequest/views/attachment.py

@@ -14,6 +14,7 @@
 
 from crossdomainmedia import CrossDomainMediaMixin
 
+from froide.helper.auth import is_crew
 from froide.helper.utils import is_ajax, render_400, render_403
 
 from ..auth import (
@@ -70,7 +71,7 @@ def approve_attachment(request, foirequest, attachment_id):
     att = get_object_or_404(
         FoiAttachment, id=attachment_id, belongs_to__request=foirequest
     )
-    if not att.can_approve and not request.user.is_crew:
+    if not att.can_approve and not is_crew(request.user):
         return render_403(request)
 
     # hard guard against publishing of non publishable requests

froide/helper/auth.py

@@ -2,9 +2,11 @@
 from operator import or_
 
 from django.contrib.auth import get_permission_codename
+from django.contrib.auth.models import AnonymousUser
 from django.core.exceptions import PermissionDenied
 from django.db.models import Q
 
+from froide.account.models import User
 from froide.team.models import Team
 
 AUTH_MAPPING = {
@@ -148,7 +150,7 @@ def get_read_queryset(
     codename = get_permission_codename("view", opts)
     if (
         token is None
-        and user.is_crew
+        and is_crew(user)
         and user.has_perm("%s.%s" % (opts.app_label, codename))
     ):
         return qs
@@ -188,7 +190,7 @@ def get_write_queryset(
     codename = get_permission_codename("change", opts)
     if (
         token is None
-        and user.is_crew
+        and is_crew(user)
         and user.has_perm("%s.%s" % (opts.app_label, codename))
     ):
         return qs
@@ -227,7 +229,7 @@ def get_user_filter(request, teams=None, fk_path=None):
 
 def require_crew(view_func):
     def decorator(request, *args, **kwargs):
-        if not request.user.is_authenticated or not request.user.is_crew:
+        if not is_crew(request.user):
             raise PermissionDenied
         return view_func(request, *args, **kwargs)
 
@@ -237,3 +239,9 @@ def decorator(request, *args, **kwargs):
 def clear_lru_caches():
     for f in ACCESS_MAPPING.values():
         f.cache_clear()
+
+
+def is_crew(user: User | AnonymousUser) -> bool:
+    if user.is_authenticated:
+        return user.is_crew
+    return False