use can_view_stats permission for stats pages

crowdsourcer/views/stats.py

@@ -23,11 +23,13 @@
 logger = logging.getLogger(__name__)
 
 
-class StatsView(UserPassesTestMixin, TemplateView):
-    template_name = "crowdsourcer/stats.html"
-
+class StatsUserTestMixin(UserPassesTestMixin):
     def test_func(self):
-        return self.request.user.is_superuser
+        return self.request.user.has_perm("crowdsourcer.can_view_stats")
+
+
+class StatsView(StatsUserTestMixin, TemplateView):
+    template_name = "crowdsourcer/stats.html"
 
     def get_context_data(self, **kwargs):
         context = super().get_context_data(**kwargs)
@@ -37,14 +39,11 @@ def get_context_data(self, **kwargs):
         return context
 
 
-class AllMarksBaseCSVView(UserPassesTestMixin, ListView):
+class AllMarksBaseCSVView(StatsUserTestMixin, ListView):
     context_object_name = "responses"
     response_type = "First Mark"
     file_name = "grace_first_mark_scores.csv"
 
-    def test_func(self):
-        return self.request.user.is_superuser
-
     def get_queryset(self):
         return (
             Response.objects.filter(
@@ -210,13 +209,10 @@ def get_context_data(self, **kwargs):
         return context
 
 
-class SelectQuestionView(UserPassesTestMixin, ListView):
+class SelectQuestionView(StatsUserTestMixin, ListView):
     template_name = "crowdsourcer/stats_select_question.html"
     context_object_name = "questions"
 
-    def test_func(self):
-        return self.request.user.is_superuser
-
     def get_queryset(self):
         return (
             Question.objects.filter(
@@ -240,7 +236,7 @@ def get_context_data(self, **kwargs):
         return context
 
 
-class QuestionDataCSVView(UserPassesTestMixin, ListView):
+class QuestionDataCSVView(StatsUserTestMixin, ListView):
     context_object_name = "responses"
     response_type = "First Mark"
     headers = [
@@ -253,9 +249,6 @@ class QuestionDataCSVView(UserPassesTestMixin, ListView):
         "private_notes",
     ]
 
-    def test_func(self):
-        return self.request.user.is_superuser
-
     def set_stage(self):
         stage = self.kwargs["stage"]
         if stage == "audit":
@@ -366,10 +359,7 @@ def get_response_data(self, response):
         return data
 
 
-class BaseScoresView(UserPassesTestMixin, TemplateView):
-    def test_func(self):
-        return self.request.user.is_superuser
-
+class BaseScoresView(StatsUserTestMixin, TemplateView):
     def get_scores(self):
         self.scoring = get_scoring_object(self.request.current_session)
 
@@ -399,9 +389,6 @@ def get_context_data(self, **kwargs):
 class WeightedScoresDataCSVView(BaseScoresView):
     file_name = "all_sections_scores.csv"
 
-    def test_func(self):
-        return self.request.user.is_superuser
-
     def get_context_data(self, **kwargs):
         ordered_sections = [
             "Buildings & Heating",
@@ -520,13 +507,9 @@ def get_context_data(self, **kwargs):
         return context
 
 
-class QuestionScoresCSV(UserPassesTestMixin, ListView):
+class QuestionScoresCSV(StatsUserTestMixin, ListView):
     context_object_name = "options"
 
-    def test_func(self):
-
-        return self.request.user.is_superuser
-
     def get_queryset(self):
         return (
             Option.objects.filter(
@@ -630,13 +613,10 @@ def render_to_response(self, context, **response_kwargs):
         return response
 
 
-class BadResponsesView(UserPassesTestMixin, ListView):
+class BadResponsesView(StatsUserTestMixin, ListView):
     context_object_name = "responses"
     template_name = "crowdsourcer/bad_responses.html"
 
-    def test_func(self):
-        return self.request.user.is_superuser
-
     def get_queryset(self):
         responses = (
             Response.objects.filter(
@@ -652,13 +632,10 @@ def get_queryset(self):
         return responses
 
 
-class DuplicateResponsesView(UserPassesTestMixin, ListView):
+class DuplicateResponsesView(StatsUserTestMixin, ListView):
     context_object_name = "responses"
     template_name = "crowdsourcer/duplicate_responses.html"
 
-    def test_func(self):
-        return self.request.user.is_superuser
-
     def get_queryset(self):
         return get_duplicate_responses(self.request.current_session)