From c612e159cf5c1be593c8760324ca94b44222754a Mon Sep 17 00:00:00 2001
From: Yohann D'ANELLO <yohann.danello@gmail.com>
Date: Mon, 10 Aug 2020 16:32:45 +0200
Subject: [PATCH] See user information does not imply see the note balance

---
 apps/member/tables.py                          | 11 ++++++-----
 apps/member/templates/member/profile_info.html |  8 +++++---
 apps/permission/fixtures/initial.json          |  3 ++-
 3 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/apps/member/tables.py b/apps/member/tables.py
index 7c2673d9..38575726 100644
--- a/apps/member/tables.py
+++ b/apps/member/tables.py
@@ -1,9 +1,9 @@
 # Copyright (C) 2018-2020 by BDE ENS Paris-Saclay
 # SPDX-License-Identifier: GPL-3.0-or-later
-from datetime import datetime
 
 import django_tables2 as tables
 from django.contrib.auth.models import User
+from django.utils import timezone
 from django.utils.translation import gettext_lazy as _
 from django.urls import reverse_lazy
 from django.utils.html import format_html
@@ -44,8 +44,9 @@ class UserTable(tables.Table):
 
     balance = tables.Column(accessor='note.balance', verbose_name=_("Balance"))
 
-    def render_balance(self, value):
-        return pretty_money(value)
+    def render_balance(self, record, value):
+        return pretty_money(value)\
+            if PermissionBackend.check_perm(get_current_authenticated_user(), "note.view_note", record.note) else "—"
 
     class Meta:
         attrs = {
@@ -105,8 +106,8 @@ class MembershipTable(tables.Table):
                     empty_membership = Membership(
                         club=record.club,
                         user=record.user,
-                        date_start=datetime.now().date(),
-                        date_end=datetime.now().date(),
+                        date_start=timezone.now().date(),
+                        date_end=timezone.now().date(),
                         fee=0,
                     )
                     if PermissionBackend.check_perm(get_current_authenticated_user(),
diff --git a/apps/member/templates/member/profile_info.html b/apps/member/templates/member/profile_info.html
index 3694fde3..5f467abf 100644
--- a/apps/member/templates/member/profile_info.html
+++ b/apps/member/templates/member/profile_info.html
@@ -1,4 +1,4 @@
-{% load i18n static pretty_money %}
+{% load i18n static pretty_money perms %}
 
 <div class="card bg-light shadow">
     <div class="card-header text-center" >
@@ -32,8 +32,10 @@
             <dt class="col-xl-6">{% trans 'address'|capfirst %}</dt>
             <dd class="col-xl-6">{{ user_object.profile.address }}</dd>
 
-            <dt class="col-xl-6">{% trans 'balance'|capfirst %}</dt>
-            <dd class="col-xl-6">{{ user_object.note.balance | pretty_money }}</dd>
+            {% if "note.view_note"|has_perm:user_object.note %}
+                <dt class="col-xl-6">{% trans 'balance'|capfirst %}</dt>
+                <dd class="col-xl-6">{{ user_object.note.balance | pretty_money }}</dd>
+            {% endif %}
 
             <dt class="col-xl-6"> <a href="{% url 'member:user_alias' user_object.pk %}">{% trans 'aliases'|capfirst %}</a></dt>
             <dd class="col-xl-6 text-truncate">{{ user_object.note.alias_set.all|join:", " }}</dd>
diff --git a/apps/permission/fixtures/initial.json b/apps/permission/fixtures/initial.json
index e068078a..80e38f6a 100644
--- a/apps/permission/fixtures/initial.json
+++ b/apps/permission/fixtures/initial.json
@@ -2910,7 +2910,8 @@
 				140,
 				145,
 				146,
-				147
+				147,
+				150
 			]
 		}
 	},