forbid non-seniors from nomination vote details

scipost_django/colleges/forms.py

@@ -681,7 +681,6 @@ class FellowshipNominationSearchForm(forms.Form):
         )
 
         if self.cleaned_data.get("can_vote"):
-            # or not self.user.has_perm("scipost.can_view_all_nomination_voting_rounds"):
             # Restrict rounds to those the user can vote on
             nominations = nominations.with_user_votable_rounds(self.user).distinct()
 

scipost_django/colleges/managers.py

@@ -146,9 +146,14 @@ class FellowshipNominationQuerySet(models.QuerySet):
         )
 
     def with_user_votable_rounds(self, user):
-        # votable_rounds = self.voting_rounds.where_user_can_vote(user)
+        # Get colleges of senior fellowships of user so that non-senior fellows
+        # cannot vote despite being on the eligible_to_vote list.
+        user_senior_fellowship_colleges = (
+            user.contributor.fellowships.senior().active().values("college")
+        )
         return self.filter(
             Q(voting_rounds__eligible_to_vote__in=user.contributor.fellowships.active())
+            & Q(voting_rounds__nomination__college__in=user_senior_fellowship_colleges)
         )
 
 

scipost_django/colleges/models/nomination.py

@@ -266,7 +266,19 @@ class FellowshipNominationVotingRound(models.Model):
 
     def can_view(self, user) -> bool:
         """Return whether the user can view this voting round.
-        They must be authenticated and have voting eligibility or be edadmin."""
+        They must either be edadmin or all of the following:
+         - authenticated
+         - a senior fellow in the nomination's college and
+         - have voting eligibility in the round."""
+
+        if not user.is_authenticated:
+            return False
+
+        if is_edadmin(user):
+            return True
+
+        fellowships = user.contributor.fellowships.active().senior()
+        senior_in_college = self.nomination.college in fellowships.values("college")
 
         eligibility_per_fellowship = [
             fellowship in self.eligible_to_vote.all()
@@ -274,7 +286,7 @@ class FellowshipNominationVotingRound(models.Model):
         ]
         eligible_to_vote = any(eligibility_per_fellowship)
 
-        return user.is_authenticated and (eligible_to_vote or is_edadmin(user))
+        return senior_in_college and eligible_to_vote
 
 
 class FellowshipNominationVote(models.Model):

scipost_django/colleges/views.py

@@ -28,7 +28,7 @@ from colleges.permissions import (
     is_edadmin_or_advisory_or_active_regular_or_senior_fellow,
 )
 from colleges.utils import check_profile_eligibility_for_fellowship
-from scipost.permissions import HTMXResponse
+from scipost.permissions import HTMXPermissionsDenied, HTMXResponse
 from submissions.models import Submission
 
 from .constants import (
@@ -802,8 +802,6 @@ def _hx_nominations_list(request):
     return render(request, "colleges/_hx_nominations_list.html", context)
 
 
-@login_required
-@user_passes_test(is_edadmin_or_advisory_or_active_regular_or_senior_fellow)
 def _hx_nomination_voting_rounds_tab(request, nomination_id, round_id):
     """Render the selected voting round contents and display the others as tabs."""
     nomination = get_object_or_404(FellowshipNomination, pk=nomination_id)
@@ -1167,8 +1165,6 @@ def _hx_nomination_round_add_eligible_voter_set(request, round_id, voter_set_nam
     )
 
 
-@login_required
-@user_passes_test(is_edadmin_or_senior_fellow)
 def _hx_voting_round_details(request, round_id):
     round = get_object_or_404(FellowshipNominationVotingRound, pk=round_id)
     context = {
@@ -1176,7 +1172,12 @@ def _hx_voting_round_details(request, round_id):
     }
 
     if not round.can_view(request.user):
-        return HTMXResponse("You are not allowed to view this round.", tag="danger")
+        return HTMXResponse(
+            "You are not allowed to vote in this round. ",
+            # "This may be because you are not a senior Fellow of the College "
+            # "or because you may not have been invited to vote in it.",
+            tag="danger",
+        )
 
     if not round.is_closed:
         voter_add_form = FellowshipDynSelForm(