codeforlife-portal 8.6.12__tar.gz → 8.7.1__tar.gz

{codeforlife_portal-8.6.12/codeforlife_portal.egg-info → codeforlife_portal-8.7.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codeforlife-portal
-Version: 8.6.12
+Version: 8.7.1
 Classifier: Programming Language :: Python
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Framework :: Django
@@ -8,7 +8,7 @@ Description-Content-Type: text/markdown
 License-File: LICENSE.md
 Requires-Dist: asgiref==3.8.1; python_version >= "3.8"
 Requires-Dist: certifi==2025.4.26; python_version >= "3.6"
-Requires-Dist: cfl-common==8.6.12
+Requires-Dist: cfl-common==8.7.1
 Requires-Dist: chardet==5.2.0; python_version >= "3.7"
 Requires-Dist: charset-normalizer==3.4.2; python_version >= "3.7"
 Requires-Dist: diff-match-patch==20241021; python_version >= "3.7"
@@ -60,7 +60,7 @@ Requires-Dist: asttokens==3.0.0; python_version >= "3.8" and extra == "dev"
 Requires-Dist: attrs==25.3.0; python_version >= "3.8" and extra == "dev"
 Requires-Dist: black==25.1.0; python_version >= "3.9" and extra == "dev"
 Requires-Dist: certifi==2025.4.26; python_version >= "3.6" and extra == "dev"
-Requires-Dist: cfl-common==8.6.12; extra == "dev"
+Requires-Dist: cfl-common==8.7.1; extra == "dev"
 Requires-Dist: charset-normalizer==3.4.2; python_version >= "3.7" and extra == "dev"
 Requires-Dist: click==8.1.8; python_version >= "3.7" and extra == "dev"
 Requires-Dist: coverage[toml]==7.8.0; python_version >= "3.9" and extra == "dev"

{codeforlife_portal-8.6.12 → codeforlife_portal-8.7.1/codeforlife_portal.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: codeforlife-portal
-Version: 8.6.12
+Version: 8.7.1
 Classifier: Programming Language :: Python
 Classifier: Programming Language :: Python :: 3.12
 Classifier: Framework :: Django
@@ -8,7 +8,7 @@ Description-Content-Type: text/markdown
 License-File: LICENSE.md
 Requires-Dist: asgiref==3.8.1; python_version >= "3.8"
 Requires-Dist: certifi==2025.4.26; python_version >= "3.6"
-Requires-Dist: cfl-common==8.6.12
+Requires-Dist: cfl-common==8.7.1
 Requires-Dist: chardet==5.2.0; python_version >= "3.7"
 Requires-Dist: charset-normalizer==3.4.2; python_version >= "3.7"
 Requires-Dist: diff-match-patch==20241021; python_version >= "3.7"
@@ -60,7 +60,7 @@ Requires-Dist: asttokens==3.0.0; python_version >= "3.8" and extra == "dev"
 Requires-Dist: attrs==25.3.0; python_version >= "3.8" and extra == "dev"
 Requires-Dist: black==25.1.0; python_version >= "3.9" and extra == "dev"
 Requires-Dist: certifi==2025.4.26; python_version >= "3.6" and extra == "dev"
-Requires-Dist: cfl-common==8.6.12; extra == "dev"
+Requires-Dist: cfl-common==8.7.1; extra == "dev"
 Requires-Dist: charset-normalizer==3.4.2; python_version >= "3.7" and extra == "dev"
 Requires-Dist: click==8.1.8; python_version >= "3.7" and extra == "dev"
 Requires-Dist: coverage[toml]==7.8.0; python_version >= "3.9" and extra == "dev"

{codeforlife_portal-8.6.12 → codeforlife_portal-8.7.1}/codeforlife_portal.egg-info/requires.txt

@@ -1,4 +1,4 @@
-cfl-common==8.6.12
+cfl-common==8.7.1
 django-countries==7.6.1
 django-csp==3.8
 django-preventconcurrentlogins==0.8.2
@@ -68,7 +68,7 @@ urllib3==2.4.0
 zipp==3.21.0
 
 [dev]
-cfl-common==8.6.12
+cfl-common==8.7.1
 django-countries==7.6.1
 django-csp==3.8
 django-selenium-clean==1.0.1

codeforlife_portal-8.7.1/portal/__init__.py

@@ -0,0 +1 @@
+__version__ = "8.7.1"

{codeforlife_portal-8.6.12 → codeforlife_portal-8.7.1}/portal/templates/portal/contribute.html

@@ -77,7 +77,7 @@
         </div>
         <div class="col-sm-6">
             <h4>How you can contribute</h4>
-            <p>Today, there is a small dedicated team working full time on Code
+            <p>Today, there is a small dedicated team working full-time on Code
                 for Life. Our community, made up of dedicated teachers, tutors,
                 students, and volunteers, has played a vital part in Code For
                 Life's growth. The resources and games are aligned to the UK

{codeforlife_portal-8.6.12 → codeforlife_portal-8.7.1}/portal/templates/portal/partials/footer.html

@@ -18,6 +18,7 @@
                         <p><a href="{% url 'privacy_notice' %}">Privacy notice</a></p>
                         <p><a href="{% url 'terms' %}">Terms of use</a></p>
                         <p><a class="optanon-toggle-display">Cookie settings</a></p>
+                        <p><a href="https://docs.codeforlife.education/">CFL community</a></p>
                     </div>
                     <div class="col-sm-4 col-xs-12">
                         <p><a href="{% url 'home-learning' %}">Home learning</a></p>

{codeforlife_portal-8.6.12 → codeforlife_portal-8.7.1}/portal/tests/test_invite_teacher.py

@@ -5,7 +5,7 @@ from uuid import uuid4
 import pytest
 from common.models import SchoolTeacherInvitation, Teacher
 from common.tests.utils.classes import create_class_directly
-from common.tests.utils.organisation import create_organisation_directly
+from common.tests.utils.organisation import create_organisation_directly, join_teacher_to_organisation
 from common.tests.utils.teacher import signup_teacher_directly
 from django.contrib.messages import get_messages
 from django.core import mail
@@ -149,8 +149,66 @@ class TestInviteTeacher(TestCase):
             "access this page."
         )
 
+    def test_invite_permissions(self):
+        # Create an admin and a standard teacher in the same school
+        admin_email, admin_password = signup_teacher_directly()
+        school = create_organisation_directly(admin_email)
+        create_class_directly(admin_email)
+
+        standard_email, standard_password = signup_teacher_directly()
+        join_teacher_to_organisation(standard_email, school.name)
+        create_class_directly(standard_email)
+
+        # Log in as standard teacher, try inviting a teacher, no invitation should be created
+        client = Client()
+        client.login(username=standard_email, password=standard_password)
+
+        dashboard_url = reverse("dashboard")
+        data = {
+            "teacher_first_name": "Valid",
+            "teacher_last_name": "Name",
+            "teacher_email": "new@teacher.com",
+            "invite_teacher": "",
+        }
+
+        response = client.post(dashboard_url, data)
+
+        assert response.status_code == 200
+        messages = list(response.context["messages"])
+        assert len(messages) == 0
+        assert len(mail.outbox) == 0
+        client.logout()
+
+        assert not SchoolTeacherInvitation.objects.filter(invited_teacher_email="new@teacher.com").exists()
+
+        # Log in as admin teacher to invite a teacher
+        client.login(username=admin_email, password=admin_password)
+
+        dashboard_url = reverse("dashboard")
+        data = {
+            "teacher_first_name": "Valid",
+            "teacher_last_name": "Name",
+            "teacher_email": "new@teacher.com",
+            "invite_teacher": "",
+        }
+
+        client.post(dashboard_url, data)
+        client.logout()
+
+        assert SchoolTeacherInvitation.objects.filter(invited_teacher_email="new@teacher.com").exists()
+        invite =  SchoolTeacherInvitation.objects.get(invited_teacher_email="new@teacher.com")
+
+        # Log in as standard teacher, try resending and deleting the invitation, both should fail
+        client.login(username=standard_email, password=standard_password)
+
+        response = client.post(reverse("resend_invite_teacher", kwargs={"token": invite.token}))
+        message = list(response.wsgi_request._messages)[0].message
+        assert message == "You do not have permission to perform this action or the invite does not exist"
+
+        response = client.post(reverse("delete_teacher_invite", kwargs={"token": invite.token}))
+        message = list(response.wsgi_request._messages)[0].message
+        assert message == "You do not have permission to perform this action or the invite does not exist"
 
-class TestTeacherInviteAPI(TestCase):
     def test_delete_exception(self):
         email, password = signup_teacher_directly()
         create_organisation_directly(email)

{codeforlife_portal-8.6.12 → codeforlife_portal-8.7.1}/portal/views/teacher/dashboard.py

@@ -29,6 +29,7 @@ from django.utils import timezone
 from django.views.decorators.http import require_POST
 from game.level_management import levels_shared_with, unshare_level
 from game.models import Level
+from game.views.level_selection import is_admin_teacher
 from two_factor.utils import devices_for_user
 
 from portal.forms.invite_teacher import InviteTeacherForm
@@ -160,7 +161,7 @@ def dashboard_teacher_view(request, is_admin):
         elif request.POST.get("show_onboarding_complete") == "1":
             show_onboarding_complete = True
 
-        elif "invite_teacher" in request.POST:
+        elif "invite_teacher" in request.POST and is_admin:
             invite_teacher_form = InviteTeacherForm(request.POST)
             if invite_teacher_form.is_valid():
                 data = invite_teacher_form.cleaned_data
@@ -674,7 +675,7 @@ def delete_teacher_invite(request, token):
     teacher = request.user.new_teacher
 
     # auth the user before deletion
-    if invite is None or teacher.school != invite.school:
+    if invite is None or teacher.school != invite.school or not is_admin_teacher(request.user):
         messages.error(
             request,
             "You do not have permission to perform this action or the invite does not exist",
@@ -698,7 +699,7 @@ def resend_invite_teacher(request, token):
     teacher = request.user.new_teacher
 
     # auth the user before deletion
-    if invite is None or teacher.school != invite.school:
+    if invite is None or teacher.school != invite.school or not is_admin_teacher(request.user):
         messages.error(
             request,
             "You do not have permission to perform this action or the invite does not exist",
@@ -706,7 +707,7 @@ def resend_invite_teacher(request, token):
     else:
         invite.expiry = timezone.now() + timedelta(days=30)
         invite.save()
-        teacher = Teacher.objects.filter(id=invite.from_teacher.id)[0]
+        teacher = Teacher.objects.filter(id=invite.from_teacher.id)
 
         messages.success(request, "Teacher re-invited!")
 

codeforlife_portal-8.6.12/portal/__init__.py

@@ -1 +0,0 @@
-__version__ = "8.6.12"