codeforlife-portal 8.6.12__py2.py3-none-any.whl → 8.7.1__py2.py3-none-any.whl

{codeforlife_portal-8.6.12.dist-info → codeforlife_portal-8.7.1.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codeforlife-portal
-Version: 8.6.12
+Version: 8.7.1
 Classifier: Programming Language :: Python
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Framework :: Django
@@ -8,7 +8,7 @@ Description-Content-Type: text/markdown
 License-File: LICENSE.md
 Requires-Dist: asgiref==3.8.1; python_version >= "3.8"
 Requires-Dist: certifi==2025.4.26; python_version >= "3.6"
-Requires-Dist: cfl-common==8.6.12
+Requires-Dist: cfl-common==8.7.1
 Requires-Dist: chardet==5.2.0; python_version >= "3.7"
 Requires-Dist: charset-normalizer==3.4.2; python_version >= "3.7"
 Requires-Dist: diff-match-patch==20241021; python_version >= "3.7"
@@ -60,7 +60,7 @@ Requires-Dist: asttokens==3.0.0; python_version >= "3.8" and extra == "dev"
 Requires-Dist: attrs==25.3.0; python_version >= "3.8" and extra == "dev"
 Requires-Dist: black==25.1.0; python_version >= "3.9" and extra == "dev"
 Requires-Dist: certifi==2025.4.26; python_version >= "3.6" and extra == "dev"
-Requires-Dist: cfl-common==8.6.12; extra == "dev"
+Requires-Dist: cfl-common==8.7.1; extra == "dev"
 Requires-Dist: charset-normalizer==3.4.2; python_version >= "3.7" and extra == "dev"
 Requires-Dist: click==8.1.8; python_version >= "3.7" and extra == "dev"
 Requires-Dist: coverage[toml]==7.8.0; python_version >= "3.9" and extra == "dev"

{codeforlife_portal-8.6.12.dist-info → codeforlife_portal-8.7.1.dist-info}/RECORD

@@ -87,7 +87,7 @@ cfl_common/common/tests/utils/organisation.py,sha256=vNgKFtU3VPcWRnZfh82yCS90PLA
 cfl_common/common/tests/utils/student.py,sha256=PLd980iSlxmMoB8J3C2pVjNC5xHdVxfAkJXzhv_dRhg,3814
 cfl_common/common/tests/utils/teacher.py,sha256=KQ_NAl4yQqiX_zwcULQjkovc29JPhnkLR5Nk3Ljzbpg,2661
 cfl_common/common/tests/utils/user.py,sha256=NvLzZLVP4jy5Hn1iztOYF_BTQ9WsbSmuWMEzGzhAsRU,919
-codeforlife_portal-8.6.12.dist-info/licenses/LICENSE.md,sha256=9AbRlCDqD2D1tPibimysFv3zg3AIc49-eyv9aEsyq9w,115
+codeforlife_portal-8.7.1.dist-info/licenses/LICENSE.md,sha256=9AbRlCDqD2D1tPibimysFv3zg3AIc49-eyv9aEsyq9w,115
 deploy/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 deploy/captcha.py,sha256=MbOBuGnbT_SOIltSjP1XMOLrfo1DldCilaVAEim0vM4,23
 deploy/views.py,sha256=7mY2zNPkaBFrlWGByJHp2zFqHIHSMc0YArjE_sFWMMU,131
@@ -111,7 +111,7 @@ example_project/portal_test_settings.py,sha256=AaXwSSB2A6qu6My_7cBciQa_jONy084uq
 example_project/settings.py,sha256=RRSHhAgJVDn4uNZG395V6_Td7jwsSaBGNwQBZ_KJm0Y,5973
 example_project/urls.py,sha256=FUTzHPlUS1O5kqMHjL5V4L552N2ln7uTDXcw9wjKUto,422
 example_project/wsgi.py,sha256=U1W6WzZxZaIdYZ5tks7w9fqp5WS5qvn2iThsVcskrWw,829
-portal/__init__.py,sha256=UXGc8nW_YrEncrkHIsp6kISjHHDaTD6JFDnD3xWh4xQ,23
+portal/__init__.py,sha256=a3FQRJoDSFET9iDvdpENKACBRF5lwOJHqpR4Y9QjQY4,22
 portal/admin.py,sha256=RKJizTF6dPJKmGPZw7nZUM0X8jkiTjgyKhLQxtvHJ0I,6148
 portal/app_settings.py,sha256=DhWLQOwM0zVOXE3O5TNKbMM9K6agfLuCsHOdr1J7xEI,651
 portal/backends.py,sha256=2Dss6_WoQwPuDzJUF1yEaTQTNG4eUrD12ujJQ5cp5Tc,812
@@ -190,7 +190,7 @@ portal/static/portal/img/dee.png,sha256=GQHNpaEiQt9M3qjb3wy6KOzlpKB1fNkESPe6yFZ7
 portal/static/portal/img/facebook.png,sha256=qaQdtT9dOg-7-XWnRxz8dW5Wwm6CEWq-S0hQDiLCWus,6543
 portal/static/portal/img/favicon.ico,sha256=vZMUaL5b47WxGRxlRMzp1fRlZQXevGHxBq5vOTV_tdg,481
 portal/static/portal/img/get_involved_hero.png,sha256=TD52SemoUt0xILs_WMxtoaKaSaXQVEQhSr2MgMNW8NY,176315
-portal/static/portal/img/gitbook.png,sha256=JgswtPQZWoIL8eY2gPEKq2RTXr6IBHVGYjzUQqgFO4o,248105
+portal/static/portal/img/gitbook.png,sha256=98fufaDz8WkaxvUM0xw6zR2qjtp_9Gk8fPBt0SXWBKY,181846
 portal/static/portal/img/gitbook_space.png,sha256=d1krFtJM36UgBu_aXW0LmGKG7QyIvp4zC6kOXBTjon0,62646
 portal/static/portal/img/github.png,sha256=NaZ4dyTsDgbTaBLJQW9hRo49uuGw6KOXZ4p7BInrVsI,63596
 portal/static/portal/img/github_hero.png,sha256=HQHyoT5IRnCGzCklqc6fJM6BOoN9ksrBN0WJD7k50ss,47014
@@ -439,7 +439,7 @@ portal/templates/portal/about.html,sha256=_iD0GCP6q3-XuZ2LC-9O0KYY-mKL6c9qk3O-NR
 portal/templates/portal/base.html,sha256=pEcfyYQjWtZk-de4NuQBcZwu9VMQFangbrpSnz3pJqg,11655
 portal/templates/portal/base_no_userprofile.html,sha256=PlRufyYmUUGWBZ6CvbYhJWOMTqKqdcee4xnO5--AogA,447
 portal/templates/portal/coding_club.html,sha256=DhPSIhxxzo6w0v80jXKVo_fjZ_TKnv7_u5cQq0woW8Q,5324
-portal/templates/portal/contribute.html,sha256=kJLQpha9uqJipiwJdEEZVk-VBOYzSBkNiuoXtIeo0Yc,4269
+portal/templates/portal/contribute.html,sha256=bhIMaUh9ucQfiudomsZJerYRuhA7963ELO7ukH7vgdw,4269
 portal/templates/portal/dotmailer_consent_form.html,sha256=UDdizPoKYZGybr6z9nzDV4WPhJPa-S3bIKywvVgFrxg,918
 portal/templates/portal/email_invitation_sent.html,sha256=hAMzQXE3NFGnOsQlCGuo3Aps-vazSJb5BhAN7bWT48M,641
 portal/templates/portal/email_style_template.html,sha256=lIlpiEC7-mO9tx3Ra9jtBjdXYxh5HKGZU8uqbvKdEbk,11893
@@ -471,7 +471,7 @@ portal/templates/portal/partials/card_list.html,sha256=yHcp4oc0WRG9H6Ek871VCHbwY
 portal/templates/portal/partials/character_list.html,sha256=SnNFHzbIkOSaiRPIvSdplEf_B87UYgJ1pOvMltNDxLE,415
 portal/templates/portal/partials/cookie_list.html,sha256=j815wyA9nAe74tzuKtp7Rxnm9oclORmipImfbI33BRI,6538
 portal/templates/portal/partials/delete_popup.html,sha256=nEhnwgnmKoFzb6LlCwdX973Em9bVOFh6MON36RPteYs,1275
-portal/templates/portal/partials/footer.html,sha256=IKEUmghaiiuQs5g9JfE97oNzjRTzBTu3SoFgJhRMyi8,5533
+portal/templates/portal/partials/footer.html,sha256=dC3eKqZ2e2gCnRsZwsFNWVEOwgwQtXrO7yfwBuW63hk,5628
 portal/templates/portal/partials/header.html,sha256=LJ8L_BV3DPAfpxAZlhH35MHNd5_bC3NhSVW2zAeonGU,20834
 portal/templates/portal/partials/headline.html,sha256=xKb-WtkT0FyQqT0smyNSKkXFvU7KQ5Czad8ca6YKQg4,89
 portal/templates/portal/partials/hero_card.html,sha256=UN5hyxrw-McuXFsDzPBIECB9yGrv9VjsFf8SEBowwXc,786
@@ -541,7 +541,7 @@ portal/tests/test_emails.py,sha256=pLr06j3uMBxP1raoZQWzUTBVFvsEDFtUh85J8OnqCwE,9
 portal/tests/test_global_forms.py,sha256=GIm_oSN4VsfaO--E2SMRu8CwVraan0UBj-_LE_tu8w0,833
 portal/tests/test_helper_methods.py,sha256=-SQCDZm2XUtyXGEp0CHIb_SSC9CPD-XOSnpnY8QclHk,890
 portal/tests/test_independent_student.py,sha256=NrRjTEr6V4WXpCE74N8LYNVocvLSvddkjuo3dYpfAZc,27245
-portal/tests/test_invite_teacher.py,sha256=QKHWVzyd5OLpTOQ0j8p9ZF6DSCWPHcWHZwCpNTFG_6o,12320
+portal/tests/test_invite_teacher.py,sha256=hynk2p63URQocCS8N6-IQnQWkdzggQ-1jGDuWcRSY_Y,14902
 portal/tests/test_middleware.py,sha256=HV7AdgWyvgrtPyDMw3np5YDbUstFpKif7Qqw-e8gs5s,8258
 portal/tests/test_organisation.py,sha256=kCMUNzLN6EzaMUBcFkqXwnqLGgOuQxQWIHHt63nhqBs,7574
 portal/tests/test_partials.py,sha256=cSLNLjdsriROjPxkZlM3HKD3CSKDuKgpaDIdL3fPyBs,1794
@@ -628,13 +628,13 @@ portal/views/student/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hS
 portal/views/student/edit_account_details.py,sha256=Ba-3D_zzKbX5N01NG5qqBS0ud10B8D5SN8hOpLiGa9U,8468
 portal/views/student/play.py,sha256=GMxk65bxWOe1Ds2kb6rvuOd1GoAtt5v_9AihLNXoUL0,8768
 portal/views/teacher/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-portal/views/teacher/dashboard.py,sha256=Y6OhT7h4hgNZAEDZDJP86F7SjrL8W12t0rpHipSYgSQ,27977
+portal/views/teacher/dashboard.py,sha256=Z5PGmyEmNSltCPMzADq2tUN66LHPVrdrtgdMgvPlrkk,28119
 portal/views/teacher/teach.py,sha256=IXlvsJ_1pX7oSr2SMWdWWC7aCFDA38IgxAoHzy_HHp4,36850
 portal/views/two_factor/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 portal/views/two_factor/core.py,sha256=Lk32z2SN2Pg0rRkK-N-LXMvXC1kKKsH3l692kiSDQ4E,964
 portal/views/two_factor/form.py,sha256=lnHNKI-BMlpncTuW3zUzjPaJJNuEra2I_nOam0eOKFY,257
 portal/views/two_factor/profile.py,sha256=SHSg_xHccE5PtD-OfuOkYhREYz_er4bj5ro1RjJ88Yw,393
-codeforlife_portal-8.6.12.dist-info/METADATA,sha256=79l8e7z65B2NIy6C8zIFXIQGKfAT99NRbEhbrstsS9Y,12321
-codeforlife_portal-8.6.12.dist-info/WHEEL,sha256=JNWh1Fm1UdwIQV075glCn4MVuCRs0sotJIq-J6rbxCU,109
-codeforlife_portal-8.6.12.dist-info/top_level.txt,sha256=8e5pdsuIoTqEAMqpelHBjGjLbffcBtgOoggmd2q7nMw,41
-codeforlife_portal-8.6.12.dist-info/RECORD,,
+codeforlife_portal-8.7.1.dist-info/METADATA,sha256=obJATb8BqSwTeVWDexVXJ5bM8Rid-sCKkyCIjbRAwC0,12318
+codeforlife_portal-8.7.1.dist-info/WHEEL,sha256=JNWh1Fm1UdwIQV075glCn4MVuCRs0sotJIq-J6rbxCU,109
+codeforlife_portal-8.7.1.dist-info/top_level.txt,sha256=8e5pdsuIoTqEAMqpelHBjGjLbffcBtgOoggmd2q7nMw,41
+codeforlife_portal-8.7.1.dist-info/RECORD,,

portal/__init__.py

@@ -1 +1 @@
-__version__ = "8.6.12"
+__version__ = "8.7.1"

portal/templates/portal/contribute.html

@@ -77,7 +77,7 @@
         </div>
         <div class="col-sm-6">
             <h4>How you can contribute</h4>
-            <p>Today, there is a small dedicated team working full time on Code
+            <p>Today, there is a small dedicated team working full-time on Code
                 for Life. Our community, made up of dedicated teachers, tutors,
                 students, and volunteers, has played a vital part in Code For
                 Life's growth. The resources and games are aligned to the UK

portal/templates/portal/partials/footer.html

@@ -18,6 +18,7 @@
                         <p><a href="{% url 'privacy_notice' %}">Privacy notice</a></p>
                         <p><a href="{% url 'terms' %}">Terms of use</a></p>
                         <p><a class="optanon-toggle-display">Cookie settings</a></p>
+                        <p><a href="https://docs.codeforlife.education/">CFL community</a></p>
                     </div>
                     <div class="col-sm-4 col-xs-12">
                         <p><a href="{% url 'home-learning' %}">Home learning</a></p>

portal/tests/test_invite_teacher.py

@@ -5,7 +5,7 @@ from uuid import uuid4
 import pytest
 from common.models import SchoolTeacherInvitation, Teacher
 from common.tests.utils.classes import create_class_directly
-from common.tests.utils.organisation import create_organisation_directly
+from common.tests.utils.organisation import create_organisation_directly, join_teacher_to_organisation
 from common.tests.utils.teacher import signup_teacher_directly
 from django.contrib.messages import get_messages
 from django.core import mail
@@ -149,8 +149,66 @@ class TestInviteTeacher(TestCase):
             "access this page."
         )
 
+    def test_invite_permissions(self):
+        # Create an admin and a standard teacher in the same school
+        admin_email, admin_password = signup_teacher_directly()
+        school = create_organisation_directly(admin_email)
+        create_class_directly(admin_email)
+
+        standard_email, standard_password = signup_teacher_directly()
+        join_teacher_to_organisation(standard_email, school.name)
+        create_class_directly(standard_email)
+
+        # Log in as standard teacher, try inviting a teacher, no invitation should be created
+        client = Client()
+        client.login(username=standard_email, password=standard_password)
+
+        dashboard_url = reverse("dashboard")
+        data = {
+            "teacher_first_name": "Valid",
+            "teacher_last_name": "Name",
+            "teacher_email": "new@teacher.com",
+            "invite_teacher": "",
+        }
+
+        response = client.post(dashboard_url, data)
+
+        assert response.status_code == 200
+        messages = list(response.context["messages"])
+        assert len(messages) == 0
+        assert len(mail.outbox) == 0
+        client.logout()
+
+        assert not SchoolTeacherInvitation.objects.filter(invited_teacher_email="new@teacher.com").exists()
+
+        # Log in as admin teacher to invite a teacher
+        client.login(username=admin_email, password=admin_password)
+
+        dashboard_url = reverse("dashboard")
+        data = {
+            "teacher_first_name": "Valid",
+            "teacher_last_name": "Name",
+            "teacher_email": "new@teacher.com",
+            "invite_teacher": "",
+        }
+
+        client.post(dashboard_url, data)
+        client.logout()
+
+        assert SchoolTeacherInvitation.objects.filter(invited_teacher_email="new@teacher.com").exists()
+        invite =  SchoolTeacherInvitation.objects.get(invited_teacher_email="new@teacher.com")
+
+        # Log in as standard teacher, try resending and deleting the invitation, both should fail
+        client.login(username=standard_email, password=standard_password)
+
+        response = client.post(reverse("resend_invite_teacher", kwargs={"token": invite.token}))
+        message = list(response.wsgi_request._messages)[0].message
+        assert message == "You do not have permission to perform this action or the invite does not exist"
+
+        response = client.post(reverse("delete_teacher_invite", kwargs={"token": invite.token}))
+        message = list(response.wsgi_request._messages)[0].message
+        assert message == "You do not have permission to perform this action or the invite does not exist"
 
-class TestTeacherInviteAPI(TestCase):
     def test_delete_exception(self):
         email, password = signup_teacher_directly()
         create_organisation_directly(email)

portal/views/teacher/dashboard.py

@@ -29,6 +29,7 @@ from django.utils import timezone
 from django.views.decorators.http import require_POST
 from game.level_management import levels_shared_with, unshare_level
 from game.models import Level
+from game.views.level_selection import is_admin_teacher
 from two_factor.utils import devices_for_user
 
 from portal.forms.invite_teacher import InviteTeacherForm
@@ -160,7 +161,7 @@ def dashboard_teacher_view(request, is_admin):
         elif request.POST.get("show_onboarding_complete") == "1":
             show_onboarding_complete = True
 
-        elif "invite_teacher" in request.POST:
+        elif "invite_teacher" in request.POST and is_admin:
             invite_teacher_form = InviteTeacherForm(request.POST)
             if invite_teacher_form.is_valid():
                 data = invite_teacher_form.cleaned_data
@@ -674,7 +675,7 @@ def delete_teacher_invite(request, token):
     teacher = request.user.new_teacher
 
     # auth the user before deletion
-    if invite is None or teacher.school != invite.school:
+    if invite is None or teacher.school != invite.school or not is_admin_teacher(request.user):
         messages.error(
             request,
             "You do not have permission to perform this action or the invite does not exist",
@@ -698,7 +699,7 @@ def resend_invite_teacher(request, token):
     teacher = request.user.new_teacher
 
     # auth the user before deletion
-    if invite is None or teacher.school != invite.school:
+    if invite is None or teacher.school != invite.school or not is_admin_teacher(request.user):
         messages.error(
             request,
             "You do not have permission to perform this action or the invite does not exist",
@@ -706,7 +707,7 @@ def resend_invite_teacher(request, token):
     else:
         invite.expiry = timezone.now() + timedelta(days=30)
         invite.save()
-        teacher = Teacher.objects.filter(id=invite.from_teacher.id)[0]
+        teacher = Teacher.objects.filter(id=invite.from_teacher.id)
 
         messages.success(request, "Teacher re-invited!")