From ff759e5d51b24e6c25a9216957a0cb4d85e4f4f3 Mon Sep 17 00:00:00 2001
From: vincent porte <vincent@neuralia.co>
Date: Thu, 8 Feb 2024 12:06:16 +0100
Subject: [PATCH] (surveys) manage permission to access survey create form,
 with tally waiting list

---
 lacommunaute/surveys/tests/test_views.py      | 27 +++++----
 .../partials/header_nav_secondary_items.html  |  8 +--
 lacommunaute/templates/surveys/dsp_form.html  | 59 ++++++++++++-------
 lacommunaute/users/factories.py               |  6 ++
 4 files changed, 62 insertions(+), 38 deletions(-)

diff --git a/lacommunaute/surveys/tests/test_views.py b/lacommunaute/surveys/tests/test_views.py
index 20b024f21..501ead442 100644
--- a/lacommunaute/surveys/tests/test_views.py
+++ b/lacommunaute/surveys/tests/test_views.py
@@ -1,7 +1,7 @@
 import pytest  # noqa
 from django.urls import reverse
 from pytest_django.asserts import assertContains, assertNotContains
-
+from django.contrib.auth.models import Permission
 from lacommunaute.surveys.factories import DSPFactory
 from lacommunaute.surveys.models import DSP
 from lacommunaute.users.factories import UserFactory
@@ -25,6 +25,18 @@ def test_login_required(self, db, client):
         response = client.get(url)
         assert response.status_code == 302
 
+    def test_user_has_no_permission(self, db, client):
+        client.force_login(UserFactory())
+        response = client.get(reverse("surveys:dsp_create"))
+        assertContains(response, '<iframe data-tally-src="https://tally.so/embed')
+        assertNotContains(response, '<form method="post">')
+
+    def test_user_has_permission(self, db, client):
+        client.force_login(UserFactory(with_perm=[Permission.objects.get(codename="add_dsp")]))
+        response = client.get(reverse("surveys:dsp_create"))
+        assertContains(response, '<form method="post">')
+        assertNotContains(response, '<iframe data-tally-src="https://tally.so/embed')
+
     def test_form_fields(self, db, client):
         url = reverse("surveys:dsp_create")
         client.force_login(UserFactory())
@@ -69,15 +81,6 @@ def test_user_can_view_own_survey(self, db, client):
 
 class TestHomeView:
     def test_link_to_dsp(self, db, client):
-        user = UserFactory()
-        client.force_login(user)
-        url = reverse("pages:home")
-        response = client.get(url)
-        assert response.status_code == 200
-        assertNotContains(response, reverse("surveys:dsp_create"))
-
-        user.is_superuser = True
-        user.save()
-        response = client.get(url)
-        assert response.status_code == 200
+        client.force_login(UserFactory())
+        response = client.get(reverse("pages:home"))
         assertContains(response, reverse("surveys:dsp_create"))
diff --git a/lacommunaute/templates/partials/header_nav_secondary_items.html b/lacommunaute/templates/partials/header_nav_secondary_items.html
index 656b94f0a..166a3e271 100644
--- a/lacommunaute/templates/partials/header_nav_secondary_items.html
+++ b/lacommunaute/templates/partials/header_nav_secondary_items.html
@@ -28,9 +28,7 @@
     <li>
         <a href="{{ calendar_url }}" class="{% if request.path == calendar_url %}is-active{% endif %}">{% trans "Events" %}</a>
     </li>
-    {% if request.user.is_superuser %}
-        <li>
-            <a href="{{ dsp_url }}">Diagnostic Parcours IAE</a>
-        </li>
-    {% endif %}
+    <li>
+        <a href="{{ dsp_url }}" class="matomo-event" data-matomo-category="engagement" data-matomo-action="view" data-matomo-option="dsp">Diagnostic Parcours IAE</a>
+    </li>
 </ul>
diff --git a/lacommunaute/templates/surveys/dsp_form.html b/lacommunaute/templates/surveys/dsp_form.html
index d9d731075..99091c1b7 100644
--- a/lacommunaute/templates/surveys/dsp_form.html
+++ b/lacommunaute/templates/surveys/dsp_form.html
@@ -18,37 +18,54 @@ <h1 class="s-title-01__title h1">Diagnostic Parcours IAE</h1>
         <div class="s-section__container container">
             <div class="s-section__row row">
                 <div class="s-section__col col-12">
-                    <div class="c-form">
-                        <form method="post">
-                            {% csrf_token %}
-                            {% for field in form %}
-                                <fieldset>
+                    {% if perms.surveys.add_dsp %}
+                        <div class="c-form">
+                            <form method="post">
+                                {% csrf_token %}
+                                {% for field in form %}
+                                    <fieldset>
+                                        <div class="row">
+                                            <div class="col-12 col-lg-8">
+                                                <legend>{{ field.label_tag }}</legend>
+                                                <div class="form-group form-group-required">{{ field }}</div>
+                                            </div>
+                                        </div>
+                                    </fieldset>
                                     <div class="row">
-                                        <div class="col-12 col-lg-8">
-                                            <legend>{{ field.label_tag }}</legend>
-                                            <div class="form-group form-group-required">{{ field }}</div>
+                                        <div class="col-12 col-lg-7">
+                                            <hr />
                                         </div>
                                     </div>
-                                </fieldset>
+                                {% endfor %}
                                 <div class="row">
                                     <div class="col-12 col-lg-7">
-                                        <hr />
-                                    </div>
-                                </div>
-                            {% endfor %}
-                            <div class="row">
-                                <div class="col-12 col-lg-7">
-                                    <div class="form-row justify-content-end">
-                                        <div class="form-group col-12 col-lg-auto">
-                                            <button type="submit" class="btn btn-block btn-primary">Valider</button>
+                                        <div class="form-row justify-content-end">
+                                            <div class="form-group col-12 col-lg-auto">
+                                                <button type="submit" class="btn btn-block btn-primary matomo-event" data-matomo-category="engagement" data-matomo-action="dsp" data-matomo-option="submit-dsp">
+                                                    Valider
+                                                </button>
+                                            </div>
                                         </div>
                                     </div>
                                 </div>
-                            </div>
-                        </form>
-                    </div>
+                            </form>
+                        </div>
+                    {% else %}
+                        <iframe data-tally-src="https://tally.so/embed/w51b56?alignLeft=1&hideTitle=1&transparentBackground=1&dynamicHeight=1"
+                                loading="lazy"
+                                width="100%"
+                                height="262"
+                                frameborder="0"
+                                marginheight="0"
+                                marginwidth="0"
+                                title="DSP waiting list"></iframe>
+                    {% endif %}
                 </div>
             </div>
         </div>
     </section>
 {% endblock content %}
+{% block extra_js %}
+    {{ block.super }}
+    <script async src="https://tally.so/widgets/embed.js"></script>
+{% endblock extra_js %}
diff --git a/lacommunaute/users/factories.py b/lacommunaute/users/factories.py
index cda945d53..d9a6a826a 100644
--- a/lacommunaute/users/factories.py
+++ b/lacommunaute/users/factories.py
@@ -33,3 +33,9 @@ class Meta:
     last_name = factory.Faker("last_name")
     email = factory.Faker("email")
     password = factory.LazyFunction(default_password)
+
+    @factory.post_generation
+    def with_perm(obj, create, extracted, **kwargs):
+        if not create or not extracted:
+            return
+        obj.user_permissions.add(*extracted)