View closed cohorts

epilepsy12/decorator.py

@@ -225,6 +225,7 @@ def wrapper(request, *args, **kwargs):
     return decorator
 
 
+# TODO MRB: replace with new_one
 def user_may_view_this_child():
     # decorator receives case_id or registration_id from view as argument.
     # access is granted only to users who are either:
@@ -319,6 +320,107 @@ def wrapper(request, *args, **kwargs):
     return decorator
 
 
+def lookup_child_if_user_has_permission(request_kwargs, user):
+    lookup = {
+        "registration_id": Registration,
+        "management_id": Management,
+        "investigations_id": Investigations,
+        "first_paediatric_assessment_id": FirstPaediatricAssessment,
+        "epilepsy_context_id": EpilepsyContext,
+        "multiaxial_diagnosis_id": MultiaxialDiagnosis,
+        "episode_id": Episode,
+        "syndrome_id": Syndrome,
+        "comorbidity_id": Comorbidity,
+        "antiepilepsy_medicine_id": AntiEpilepsyMedicine,
+        "assessment_id": Assessment,
+        "case_id": Case,
+    }
+
+    for key, model in lookup.items():
+        pk = request_kwargs.get(key)
+
+        if pk is not None:
+            obj = model.objects.get(pk=pk)
+
+            if model == Registration:
+                child = obj.case
+            elif model == Case:
+                child = obj
+            else:
+                child = obj.registration.case
+
+            org_filters = {
+                "cases": child,
+                "patient_sites__site_is_actively_involved_in_epilepsy_care": True,
+                "patient_sites__site_is_primary_centre_of_epilepsy_care": True,
+                # Access is sliced by trust - so members of other organisations in that trust can see data
+                "trust": user.organisation_employer.trust,
+            }
+
+            if Organisation.objects.filter(**org_filters).exists():
+                return child
+
+
+def lookup_user_permissions_on_child(request, request_kwargs):
+    # Lookup sub object by id and walk backwards to case.
+    # Access is granted only to users who are either:
+    # 1. superusers
+    # 2. Active RCPCH audit members
+    # 3. Active trust level users where their trust is the same as the child
+    # Editing is allowed if the cohort is still open or if you are an RCPCH audit member
+    user = request.user
+    is_admin = user.is_rcpch_audit_team_member or user.is_rcpch_staff or user.is_superuser
+
+    if is_admin:
+        return {
+            "can_view": True,
+            "can_edit": True,
+        }
+
+    child = lookup_child_if_user_has_permission(request_kwargs, request.user)
+
+    if child:
+        return {
+            "can_view": True,
+            "can_edit": child.editable(),
+        }
+
+    return {
+        "can_view": False,
+        "can_edit": False,
+    }
+
+
+def user_may_view_this_child_2():
+    def decorator(view):
+        def wrapper(request, *args, **kwargs):
+            permissions = lookup_user_permissions_on_child(request, kwargs)
+
+            if permissions["can_view"]:
+                return view(request, permissions["can_edit"], *args, **kwargs)
+
+            raise PermissionDenied()
+
+        return wrapper
+
+    return decorator
+
+
+def user_may_edit_this_child():
+    def decorator(view):
+        def wrapper(request, *args, **kwargs):
+            permissions = lookup_user_permissions_on_child(request, kwargs)
+
+            if permissions["can_edit"]:
+                return view(request, *args, **kwargs)
+
+            raise PermissionDenied()
+
+        return wrapper
+
+    return decorator
+
+
 def rcpch_full_access_only():
     """
     Only permits access to rcpch_audit_team_full_access group members

epilepsy12/tests/view_tests/permissions_tests/test_permissions_update.py

@@ -884,6 +884,11 @@ def test_users_update_first_paediatric_assessment_success(client, e12_case_facto
         organisations__organisation=TEST_USER_ORGANISATION,
     )
 
+    # https://github.com/rcpch/rcpch-audit-engine/pull/1346
+    # Case must be registered to an open cohort
+    CASE_FROM_SAME_ORG.registration.first_paediatric_assessment_date = date.today()
+    CASE_FROM_SAME_ORG.registration.save()
+
     user_first_names_for_test = [
         test_user_audit_centre_clinician_data.role_str,
         test_user_audit_centre_lead_clinician_data.role_str,
@@ -1037,6 +1042,11 @@ def test_users_update_epilepsy_context_success(client, e12_case_factory):
         organisations__organisation=TEST_USER_ORGANISATION,
     )
 
+    # https://github.com/rcpch/rcpch-audit-engine/pull/1346
+    # Case must be registered to an open cohort
+    CASE_FROM_SAME_ORG.registration.first_paediatric_assessment_date = date.today()
+    CASE_FROM_SAME_ORG.registration.save()
+
     user_first_names_for_test = [
         test_user_audit_centre_clinician_data.role_str,
         test_user_audit_centre_lead_clinician_data.role_str,

epilepsy12/views/assessment_views.py

@@ -6,7 +6,7 @@
     validate_and_update_model,
     recalculate_form_generate_response,
 )
-from ..decorator import user_may_view_this_child, login_and_otp_required
+from ..decorator import user_may_view_this_child, user_may_view_this_child_2, login_and_otp_required
 
 
 def update_site_model(
@@ -1102,8 +1102,8 @@ def delete_paediatric_neurology_centre(request, assessment_id, site_id):
 
 @login_and_otp_required()
 @permission_required("epilepsy12.change_assessment", raise_exception=True)
-@user_may_view_this_child()
-def childrens_epilepsy_surgical_service_referral_criteria_met(request, assessment_id):
+@user_may_view_this_child_2()
+def childrens_epilepsy_surgical_service_referral_criteria_met(request, editable, assessment_id):
     """
     This is an HTMX callback from the epilepsy_surgery partial template
     It is triggered by a toggle in the partial generating a post request
@@ -1129,8 +1129,8 @@ def childrens_epilepsy_surgical_service_referral_criteria_met(request, assessmen
     context = {
         "assessment": assessment,
         "organisation_list": organisation_list,
-        "show_input_date": assessment.childrens_epilepsy_surgical_service_input_date
-        is not None,
+        "show_input_date": assessment.childrens_epilepsy_surgical_service_input_date is not None,
+        "enabled": editable,
     }
 
     template_name = "epilepsy12/partials/assessment/epilepsy_surgery.html"
@@ -1819,8 +1819,8 @@ def epilepsy_specialist_nurse_input_date(request, assessment_id):
 
 @login_and_otp_required()
 @permission_required("epilepsy12.view_assessment", raise_exception=True)
-@user_may_view_this_child()
-def assessment(request, case_id):
+@user_may_view_this_child_2()
+def assessment(request, editable, case_id):
     case = Case.objects.get(pk=case_id)
     registration = Registration.objects.filter(case=case).get()
 
@@ -1849,8 +1849,8 @@ def assessment(request, case_id):
         "active_template": "assessment",
         "organisation_list": organisation_list,
         "organisation_id": organisation_id,
-        "show_input_date": assessment.childrens_epilepsy_surgical_service_input_date
-        is not None,
+        "show_input_date": assessment.childrens_epilepsy_surgical_service_input_date is not None,
+        "enabled": editable and request.user.has_perm("epilepsy12.change_assessment"),
     }
 
     # add previous and current sites to context

epilepsy12/views/epilepsy_context_views.py

@@ -1,5 +1,5 @@
 from django.contrib.auth.decorators import permission_required
-from ..decorator import user_may_view_this_child, login_and_otp_required
+from ..decorator import user_may_view_this_child_2, user_may_edit_this_child, login_and_otp_required
 from epilepsy12.constants.common import OPT_OUT_UNCERTAIN
 from ..models import EpilepsyContext, Registration, Site
 from ..common_view_functions import (
@@ -9,9 +9,9 @@
 
 
 @login_and_otp_required()
-@user_may_view_this_child()
+@user_may_view_this_child_2()
 @permission_required("epilepsy12.view_epilepsycontext", raise_exception=True)
-def epilepsy_context(request, case_id):
+def epilepsy_context(request, editable, case_id):
     registration = Registration.objects.filter(case=case_id).first()
 
     epilepsy_context, created = EpilepsyContext.objects.get_or_create(
@@ -27,6 +27,7 @@ def epilepsy_context(request, case_id):
 
     context = {
         "case_id": case_id,
+        "disabled": not editable or not request.user.has_perm("change_epilepsycontext"),
         "registration": registration,
         "epilepsy_context": epilepsy_context,
         "uncertain_choices": OPT_OUT_UNCERTAIN,
@@ -46,7 +47,7 @@ def epilepsy_context(request, case_id):
 
 
 @login_and_otp_required()
-@user_may_view_this_child()
+@user_may_edit_this_child()
 @permission_required("epilepsy12.change_epilepsycontext", raise_exception=True)
 def previous_febrile_seizure(request, epilepsy_context_id):
     """
@@ -87,7 +88,7 @@ def previous_febrile_seizure(request, epilepsy_context_id):
 
 
 @login_and_otp_required()
-@user_may_view_this_child()
+@user_may_edit_this_child()
 @permission_required("epilepsy12.change_epilepsycontext", raise_exception=True)
 def previous_acute_symptomatic_seizure(request, epilepsy_context_id):
     """
@@ -128,7 +129,7 @@ def previous_acute_symptomatic_seizure(request, epilepsy_context_id):
 
 
 @login_and_otp_required()
-@user_may_view_this_child()
+@user_may_edit_this_child()
 @permission_required("epilepsy12.change_epilepsycontext", raise_exception=True)
 def is_there_a_family_history_of_epilepsy(request, epilepsy_context_id):
     """
@@ -169,7 +170,7 @@ def is_there_a_family_history_of_epilepsy(request, epilepsy_context_id):
 
 
 @login_and_otp_required()
-@user_may_view_this_child()
+@user_may_edit_this_child()
 @permission_required("epilepsy12.change_epilepsycontext", raise_exception=True)
 def previous_neonatal_seizures(request, epilepsy_context_id):
     """
@@ -210,7 +211,7 @@ def previous_neonatal_seizures(request, epilepsy_context_id):
 
 
 @login_and_otp_required()
-@user_may_view_this_child()
+@user_may_edit_this_child()
 @permission_required("epilepsy12.change_epilepsycontext", raise_exception=True)
 def were_any_of_the_epileptic_seizures_convulsive(request, epilepsy_context_id):
     """
@@ -250,7 +251,7 @@ def were_any_of_the_epileptic_seizures_convulsive(request, epilepsy_context_id):
 
 
 @login_and_otp_required()
-@user_may_view_this_child()
+@user_may_edit_this_child()
 @permission_required("epilepsy12.change_epilepsycontext", raise_exception=True)
 def experienced_prolonged_generalized_convulsive_seizures(request, epilepsy_context_id):
     """
@@ -291,7 +292,7 @@ def experienced_prolonged_generalized_convulsive_seizures(request, epilepsy_cont
 
 
 @login_and_otp_required()
-@user_may_view_this_child()
+@user_may_edit_this_child()
 @permission_required("epilepsy12.change_epilepsycontext", raise_exception=True)
 def experienced_prolonged_focal_seizures(request, epilepsy_context_id):
     """
@@ -332,7 +333,7 @@ def experienced_prolonged_focal_seizures(request, epilepsy_context_id):
 
 
 @login_and_otp_required()
-@user_may_view_this_child()
+@user_may_edit_this_child()
 @permission_required("epilepsy12.change_epilepsycontext", raise_exception=True)
 def diagnosis_of_epilepsy_withdrawn(request, epilepsy_context_id):
     """
@@ -356,7 +357,9 @@ def diagnosis_of_epilepsy_withdrawn(request, epilepsy_context_id):
 
     epilepsy_context = EpilepsyContext.objects.get(pk=epilepsy_context_id)
 
-    context = {"epilepsy_context": epilepsy_context}
+    context = {
+        "epilepsy_context": epilepsy_context,
+    }
 
     response = recalculate_form_generate_response(
         model_instance=epilepsy_context,

epilepsy12/views/first_paediatric_assessment_views.py

@@ -1,18 +1,19 @@
 from django.contrib.auth.decorators import permission_required
 from django.http import HttpResponse
 from epilepsy12.constants import *
+from epilepsy12.models_folder import registration
 from ..common_view_functions import (
     validate_and_update_model,
     recalculate_form_generate_response,
 )
 from ..models import Registration, FirstPaediatricAssessment, Site
-from ..decorator import user_may_view_this_child, login_and_otp_required
+from ..decorator import user_may_view_this_child_2, user_may_edit_this_child, login_and_otp_required
 
 
 @login_and_otp_required()
 @permission_required("epilepsy12.view_firstpaediatricassessment", raise_exception=True)
-@user_may_view_this_child()
-def first_paediatric_assessment(request, case_id) -> HttpResponse:
+@user_may_view_this_child_2()
+def first_paediatric_assessment(request, editable, case_id) -> HttpResponse:
     registration = Registration.objects.get(case=case_id)
 
     if FirstPaediatricAssessment.objects.filter(registration=registration).exists():
@@ -37,6 +38,7 @@ def first_paediatric_assessment(request, case_id) -> HttpResponse:
 
     context = {
         "case_id": case_id,
+        "disabled": not editable or not request.user.has_perm("change_firstpaediatricassessment"),
         "registration": registration,
         "first_paediatric_assessment": first_paediatric_assessment,
         "chronicity_selection": CHRONICITY,
@@ -58,7 +60,7 @@ def first_paediatric_assessment(request, case_id) -> HttpResponse:
 
 
 @login_and_otp_required()
-@user_may_view_this_child()
+@user_may_edit_this_child()
 @permission_required(
     "epilepsy12.change_firstpaediatricassessment", raise_exception=True
 )
@@ -105,7 +107,7 @@ def first_paediatric_assessment_in_acute_or_nonacute_setting(
 
 
 @login_and_otp_required()
-@user_may_view_this_child()
+@user_may_edit_this_child()
 @permission_required(
     "epilepsy12.change_firstpaediatricassessment", raise_exception=True
 )
@@ -150,7 +152,7 @@ def has_number_of_episodes_since_the_first_been_documented(
 
 
 @login_and_otp_required()
-@user_may_view_this_child()
+@user_may_edit_this_child()
 @permission_required(
     "epilepsy12.change_firstpaediatricassessment", raise_exception=True
 )
@@ -192,7 +194,7 @@ def general_examination_performed(request, first_paediatric_assessment_id):
 
 
 @login_and_otp_required()
-@user_may_view_this_child()
+@user_may_edit_this_child()
 @permission_required(
     "epilepsy12.change_firstpaediatricassessment", raise_exception=True
 )
@@ -234,7 +236,7 @@ def neurological_examination_performed(request, first_paediatric_assessment_id):
 
 
 @login_and_otp_required()
-@user_may_view_this_child()
+@user_may_edit_this_child()
 @permission_required(
     "epilepsy12.change_firstpaediatricassessment", raise_exception=True
 )
@@ -278,7 +280,7 @@ def developmental_learning_or_schooling_problems(
 
 
 @login_and_otp_required()
-@user_may_view_this_child()
+@user_may_edit_this_child()
 @permission_required(
     "epilepsy12.change_firstpaediatricassessment", raise_exception=True
 )

epilepsy12/views/investigation_views.py

@@ -45,6 +45,7 @@ def investigations(request, case_id):
         "organisation_id": organisation_id,
         "eeg_declined": eeg_declined,
         "mri_brain_declined": mri_brain_declined,
+        "enabled": request.user.is_rcpch_audit_team_member or (registration.case.editable() and request.user.has_perm("epilepsy12.change_investigations")),
     }
 
     template_name = "epilepsy12/investigations.html"