From 8393e85b74ef42ba01c736451634e5bc8ef03dbd Mon Sep 17 00:00:00 2001
From: Arona Jones <aj@aronajones.com>
Date: Fri, 16 Dec 2022 14:25:55 +0000
Subject: [PATCH] Add appropriate permissions for subhire

---
 RIGS/migrations/0047_alter_subhire_options.py | 17 +++++++++++++++++
 RIGS/models.py                                |  5 +++++
 RIGS/templates/subhire_detail.html            |  4 +++-
 RIGS/urls.py                                  |  6 +++---
 4 files changed, 28 insertions(+), 4 deletions(-)
 create mode 100644 RIGS/migrations/0047_alter_subhire_options.py

diff --git a/RIGS/migrations/0047_alter_subhire_options.py b/RIGS/migrations/0047_alter_subhire_options.py
new file mode 100644
index 00000000..7c5323a6
--- /dev/null
+++ b/RIGS/migrations/0047_alter_subhire_options.py
@@ -0,0 +1,17 @@
+# Generated by Django 3.2.16 on 2022-12-16 14:22
+
+from django.db import migrations
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('RIGS', '0046_subhire'),
+    ]
+
+    operations = [
+        migrations.AlterModelOptions(
+            name='subhire',
+            options={'permissions': [('subhire_finance', 'Can see financial data for subhire - insurance values')]},
+        ),
+    ]
diff --git a/RIGS/models.py b/RIGS/models.py
index 33d06c59..027fe260 100644
--- a/RIGS/models.py
+++ b/RIGS/models.py
@@ -642,6 +642,11 @@ class Subhire(BaseEvent):
     def earliest_time(self):
         return find_earliest_event_time(self, [])
 
+    class Meta:
+        permissions = [
+            ('subhire_finance', 'Can see financial data for subhire - insurance values')
+        ]
+
 
 class InvoiceManager(models.Manager):
     def outstanding_invoices(self):
diff --git a/RIGS/templates/subhire_detail.html b/RIGS/templates/subhire_detail.html
index f5c723ec..ae4b6c72 100644
--- a/RIGS/templates/subhire_detail.html
+++ b/RIGS/templates/subhire_detail.html
@@ -40,15 +40,17 @@
                 <dl class="row">
                     <dt class="col-sm-6">Description</dt>
                     <dd class="col-sm-6">{{ object.description }}</dd>
+                    {% if perms.RIGS.subhire_finance %}
                     <dt class="col-sm-6">Insurance Value</dt>
                     <dd class="col-sm-6">£{{ object.insurance_value }}</dd>
+                    {% endif %}
                 </dl>
             </div>
         </div>
     </div>
     <div class="col-md-12 mt-2">
         <div class="card card-default">
-            <div class="card-header">Associated Events</div>
+            <div class="card-header">Associated Event(s)</div>
             {% with object.events.all as events %}
                 {% include 'partials/event_table.html' %}
             {%endwith%}
diff --git a/RIGS/urls.py b/RIGS/urls.py
index d3fe3be6..13c9c907 100644
--- a/RIGS/urls.py
+++ b/RIGS/urls.py
@@ -68,13 +68,13 @@ urlpatterns = [
 
 
     # Subhire
-    path('subhire/<int:pk>/', views.SubhireDetail.as_view(),
+    path('subhire/<int:pk>/', login_required(views.SubhireDetail.as_view()),
           name='subhire_detail'),
     path('subhire/create/', permission_required_with_403('RIGS.add_event')(views.SubhireCreate.as_view()),
           name='subhire_create'),
-    path('subhire/<int:pk>/edit', views.SubhireEdit.as_view(),
+    path('subhire/<int:pk>/edit', permission_required_with_403('RIGS.change_event')(views.SubhireEdit.as_view()),
           name='subhire_update'),
-    path('subhire/upcoming', views.SubhireList.as_view(),
+    path('subhire/upcoming', login_required(views.SubhireList.as_view()),
           name='subhire_list'),
 
      # Dashboards