Portal frontend 52 (#364)

* fix query set

* install new cfl package

Pipfile

@@ -23,7 +23,7 @@ name = "pypi"
 # 5. Run `pipenv install --dev` in your terminal.
 
 [packages]
-codeforlife = {ref = "v0.18.12", git = "https://github.com/ocadotechnology/codeforlife-package-python.git"}
+codeforlife = {ref = "v0.18.13", git = "https://github.com/ocadotechnology/codeforlife-package-python.git"}
 # 🚫 Don't add [packages] below that are inherited from the CFL package.
 pyjwt = "==2.6.0" # TODO: upgrade to latest version
 # TODO: Needed by RR. Remove when RR has moved to new system.
@@ -32,7 +32,7 @@ django-sekizai = "==2.0.0"
 django-classy-tags = "==2.0.0"
 
 [dev-packages]
-codeforlife = {ref = "v0.18.12", git = "https://github.com/ocadotechnology/codeforlife-package-python.git", extras = ["dev"]}
+codeforlife = {ref = "v0.18.13", git = "https://github.com/ocadotechnology/codeforlife-package-python.git", extras = ["dev"]}
 # codeforlife = {file = "../codeforlife-package-python", editable = true, extras = ["dev"]}
 # 🚫 Don't add [dev-packages] below that are inherited from the CFL package.
 

src/api/views/klass.py

@@ -37,6 +37,17 @@ def get_serializer_class(self):
 
         return ReadClassSerializer
 
+    def get_queryset(self):
+        if self.action in ["retrieve", "list"]:
+            return super().get_queryset()
+
+        teacher = self.request.school_teacher_user.teacher
+        return (
+            teacher.classes
+            if teacher.is_admin
+            else teacher.classes.filter(teacher=teacher)
+        )
+
     def destroy(self, request, *args, **kwargs):
         klass = self.get_object()
 

src/api/views/klass_test.py

@@ -85,9 +85,7 @@ def test_get_permissions__destroy(self):
     def test_get_permissions__list(self):
         """Only admin-teachers and class-teachers can list classes."""
         self.assert_get_permissions(
-            permissions=[
-                OR(IsTeacher(is_admin=True), IsTeacher(in_class=True))
-            ],
+            permissions=[IsTeacher(in_school=True)],
             action="list",
         )
 
@@ -96,12 +94,7 @@ def test_get_permissions__retrieve(self):
         Only students, admin-teachers or class-teachers can retrieve a class.
         """
         self.assert_get_permissions(
-            permissions=[
-                OR(
-                    IsStudent(),
-                    OR(IsTeacher(is_admin=True), IsTeacher(in_class=True)),
-                )
-            ],
+            permissions=[OR(IsStudent(), IsTeacher(in_school=True))],
             action="retrieve",
         )