Bulk anon students (#300)

* install latest py package

* bulk anonymize students

* fix test cases

* fix permissions

* new python package

backend/Pipfile

@@ -7,7 +7,7 @@ name = "pypi"
 # Before adding a new package, check it's not listed under [packages] at
 #   https://github.com/ocadotechnology/codeforlife-package-python/blob/{ref}/Pipfile
 # Replace "{ref}" in the above URL with the ref set below.
-codeforlife = {ref = "v0.13.4", git = "https://github.com/ocadotechnology/codeforlife-package-python.git"}
+codeforlife = {ref = "v0.13.6", git = "https://github.com/ocadotechnology/codeforlife-package-python.git"}
 # TODO: check if we need the below packages
 whitenoise = "==6.5.0"
 django-pipeline = "==2.0.8"
@@ -34,7 +34,7 @@ google-cloud-container = "==2.3.0"
 # Before adding a new package, check it's not listed under [dev-packages] at
 #   https://github.com/ocadotechnology/codeforlife-package-python/blob/{ref}/Pipfile
 # Replace "{ref}" in the above URL with the ref set below.
-codeforlife = {ref = "v0.13.4", git = "https://github.com/ocadotechnology/codeforlife-package-python.git", extras = ["dev"]}
+codeforlife = {ref = "v0.13.6", git = "https://github.com/ocadotechnology/codeforlife-package-python.git", extras = ["dev"]}
 # TODO: check if we need the below packages
 django-selenium-clean = "==0.3.3"
 django-test-migrations = "==1.2.0"

backend/api/tests/views/test_klass.py

@@ -5,10 +5,10 @@
 
 from datetime import timedelta
 
-from codeforlife.permissions import AllowNone
+from codeforlife.permissions import OR, AllowNone
 from codeforlife.tests import ModelViewSetTestCase
 from codeforlife.user.models import Class, Teacher
-from codeforlife.user.permissions import InSchool, IsTeacher
+from codeforlife.user.permissions import IsStudent, IsTeacher
 from django.utils import timezone
 
 from ...views import ClassViewSet
@@ -20,63 +20,60 @@ class TestClassViewSet(ModelViewSetTestCase[Class]):
     model_view_set_class = ClassViewSet
     fixtures = ["school_1"]
 
-    def test_get_permissions__bulk(self):
-        """
-        No one is allowed to perform bulk actions.
-        """
+    # test: get permissions
 
+    def test_get_permissions__bulk(self):
+        """No one is allowed to perform bulk actions."""
         self.assert_get_permissions(
             permissions=[AllowNone()],
             action="bulk",
         )
 
     def test_get_permissions__create(self):
-        """
-        Only a school-teacher can create a class.
-        """
-
+        """Only school-teachers can create a class."""
         self.assert_get_permissions(
-            permissions=[IsTeacher(), InSchool()],
+            permissions=[IsTeacher(in_school=True)],
             action="create",
         )
 
     def test_get_permissions__update(self):
-        """
-        Only a school-teacher can update a class.
-        """
-
+        """Only admin-teachers or class-teachers can update a class."""
         self.assert_get_permissions(
-            permissions=[IsTeacher(), InSchool()],
+            permissions=[
+                OR(IsTeacher(is_admin=True), IsTeacher(in_class=True))
+            ],
             action="update",
         )
 
     def test_get_permissions__destroy(self):
-        """
-        Only a school-teacher can destroy a class.
-        """
-
+        """Only admin-teachers or class-teachers can destroy a class."""
         self.assert_get_permissions(
-            permissions=[IsTeacher(), InSchool()],
+            permissions=[
+                OR(IsTeacher(is_admin=True), IsTeacher(in_class=True))
+            ],
             action="destroy",
         )
 
     def test_get_permissions__list(self):
-        """
-        Only a school-teacher can list classes.
-        """
-
+        """Only admin-teachers and class-teachers can list classes."""
         self.assert_get_permissions(
-            permissions=[IsTeacher(), InSchool()],
+            permissions=[
+                OR(IsTeacher(is_admin=True), IsTeacher(in_class=True))
+            ],
             action="list",
         )
 
     def test_get_permissions__retrieve(self):
         """
-        Any school-user can retrieve a class.
+        Only students, admin-teachers or class-teachers can retrieve a class.
         """
-
         self.assert_get_permissions(
-            permissions=[InSchool()],
+            permissions=[
+                OR(
+                    IsStudent(),
+                    OR(IsTeacher(is_admin=True), IsTeacher(in_class=True)),
+                )
+            ],
             action="retrieve",
         )
 
@@ -104,10 +101,9 @@ def test_create__other(self):
         Teacher can create a class with another teacher as the class owner.
         """
 
-        user = self.client.login_school_teacher(
+        user = self.client.login_admin_school_teacher(
             email="[email protected]",
             password="password",
-            is_admin=True,
         )
 
         teacher = (

backend/api/tests/views/test_school.py

@@ -3,10 +3,10 @@
 Created on 02/02/2024 at 15:31:21(+00:00).
 """
 
-from codeforlife.permissions import NOT, AllowNone
+from codeforlife.permissions import OR, AllowNone
 from codeforlife.tests import ModelViewSetTestCase
 from codeforlife.user.models import School
-from codeforlife.user.permissions import InSchool, IsTeacher
+from codeforlife.user.permissions import IsStudent, IsTeacher
 
 from ...views import SchoolViewSet
 
@@ -37,23 +37,23 @@ def test_get_permissions__create(self):
         """Only teachers not in a school can create a school."""
 
         self.assert_get_permissions(
-            permissions=[IsTeacher(), NOT(InSchool())],
+            permissions=[IsTeacher(in_school=False)],
             action="create",
         )
 
     def test_get_permissions__update(self):
         """Only admin-teachers in a school can update a school."""
 
         self.assert_get_permissions(
-            permissions=[IsTeacher(is_admin=True), InSchool()],
+            permissions=[IsTeacher(is_admin=True)],
             action="update",
         )
 
     def test_get_permissions__retrieve(self):
         """Anyone in a school can retrieve a school."""
 
         self.assert_get_permissions(
-            permissions=[InSchool()],
+            permissions=[OR(IsStudent(), IsTeacher(in_school=True))],
             action="retrieve",
         )
 
@@ -76,8 +76,7 @@ def test_create(self):
     def test_partial_update(self):
         """Can successfully update a school."""
 
-        user = self.client.login_school_teacher(
-            is_admin=True,
+        user = self.client.login_admin_school_teacher(
             email="[email protected]",
             password="password",
         )

backend/api/tests/views/test_school_teacher_invitation.py

@@ -6,7 +6,7 @@
 from codeforlife.permissions import AllowNone
 from codeforlife.tests import ModelViewSetTestCase
 from codeforlife.user.models import User
-from codeforlife.user.permissions import InSchool, IsTeacher
+from codeforlife.user.permissions import IsTeacher
 from rest_framework import status
 
 from ...models import SchoolTeacherInvitation
@@ -24,10 +24,9 @@ class TestSchoolTeacherInvitationViewSet(
     non_school_teacher_email = "[email protected]"
 
     def _login_admin_school_teacher(self):
-        return self.client.login_school_teacher(
+        return self.client.login_admin_school_teacher(
             email=self.school_admin_teacher_email,
             password="password",
-            is_admin=True,
         )
 
     def setUp(self):
@@ -60,35 +59,35 @@ def test_get_permissions__bulk(self):
     def test_get_permissions__create(self):
         """Only admin-teachers can create an invitation."""
         self.assert_get_permissions(
-            permissions=[IsTeacher(is_admin=True), InSchool()],
+            permissions=[IsTeacher(is_admin=True)],
             action="create",
         )
 
     def test_get_permissions__partial_update(self):
         """Only admin-teachers can update an invitation."""
         self.assert_get_permissions(
-            permissions=[IsTeacher(is_admin=True), InSchool()],
+            permissions=[IsTeacher(is_admin=True)],
             action="partial_update",
         )
 
     def test_get_permissions__retrieve(self):
         """Only admin-teachers can retrieve an invitation."""
         self.assert_get_permissions(
-            permissions=[IsTeacher(is_admin=True), InSchool()],
+            permissions=[IsTeacher(is_admin=True)],
             action="retrieve",
         )
 
     def test_get_permissions__list(self):
         """Only admin-teachers can list invitations."""
         self.assert_get_permissions(
-            permissions=[IsTeacher(is_admin=True), InSchool()],
+            permissions=[IsTeacher(is_admin=True)],
             action="list",
         )
 
     def test_get_permissions__destroy(self):
         """Only admin-teachers can destroy an invitation."""
         self.assert_get_permissions(
-            permissions=[IsTeacher(is_admin=True), InSchool()],
+            permissions=[IsTeacher(is_admin=True)],
             action="destroy",
         )