members/waitinglist: fix permissions

jdav_web/members/admin.py

@@ -443,6 +443,20 @@ class MemberUnconfirmedAdmin(CommonAdminMixin, admin.ModelAdmin):
     inlines = [EmergencyContactInline]
     change_form_template = "members/change_member_unconfirmed.html"
 
+    field_view_permissions = {
+        'user': 'members.may_set_auth_user',
+        'good_conduct_certificate_presented_date': 'members.may_change_organizationals',
+        'has_key': 'members.may_change_organizationals',
+        'has_free_ticket_gym': 'members.may_change_organizationals',
+    }
+
+    field_change_permissions = {
+        'user': 'members.may_set_auth_user',
+        'good_conduct_certificate_presented_date': 'members.may_change_organizationals',
+        'has_key': 'members.may_change_organizationals',
+        'has_free_ticket_gym': 'members.may_change_organizationals',
+    }
+
     def has_add_permission(self, request, obj=None):
         return False
 
@@ -554,7 +568,7 @@ class WaiterInviteForm(forms.Form):
                                    label=_('Group'))
 
 
-class InvitationToGroupAdmin(CommonAdminInlineMixin, admin.TabularInline):
+class InvitationToGroupAdmin(admin.TabularInline):
     model = InvitationToGroup
     fields = ['group', 'date', 'status']
     readonly_fields = ['group', 'date', 'status']

jdav_web/members/models.py

@@ -498,6 +498,8 @@ class Member(Person):
             return queryset
         elif name == "EmergencyContact":
             return queryset
+        elif name == "MemberUnconfirmedProxy":
+            return queryset
         else:
             raise ValueError(name)
 
@@ -731,6 +733,11 @@ class MemberUnconfirmedProxy(Member):
         verbose_name = _('Unconfirmed registration')
         verbose_name_plural = _('Unconfirmed registrations')
         permissions = (('may_manage_all_registrations', 'Can view and manage all unconfirmed registrations.'),)
+        rules_permissions = {
+            'view_obj': may_view | has_global_perm('members.may_manage_all_registrations'),
+            'change_obj': may_change | has_global_perm('members.may_manage_all_registrations'),
+            'delete_obj': may_delete | has_global_perm('members.may_manage_all_registrations'),
+        }
 
     def __str__(self):
         """String representation"""

jdav_web/templates/admin/members/app_index.html

@@ -24,7 +24,7 @@ Hier siehst du alle Teilnehmer*innen deiner Jugendgruppen und alle von dir gelei
     </tr>
 </table>
 <table>
-{% if perms.members.change_waitinglist %}
+{% if perms.members.may_manage_waiting_list %}
 <br>
 <div class="app-members module current-app">
 <h2>Neue Mitglieder</h2>