[FM] Don't allow staff to approve your own report

src/etools/applications/field_monitoring/planning/models.py

@@ -25,8 +25,8 @@
 from etools.applications.field_monitoring.fm_settings.models import LocationSite, Method, Option, Question
 from etools.applications.field_monitoring.planning.mixins import ProtectUnknownTransitionsMeta
 from etools.applications.field_monitoring.planning.transitions.permissions import (
+    approve_final_report_permission,
     user_is_field_monitor_permission,
-    user_is_pme_or_approver_or_reviewer_permission,
     user_is_visit_lead_permission,
 )
 from etools.applications.locations.models import Location
@@ -578,12 +578,12 @@ def submit_report(self):
         pass
 
     @transition(field=status, source=STATUSES.submitted, target=STATUSES.completed,
-                permission=user_is_pme_or_approver_or_reviewer_permission)
+                permission=approve_final_report_permission)
     def complete(self):
         pass
 
     @transition(field=status, source=STATUSES.submitted, target=STATUSES.report_finalization,
-                permission=user_is_pme_or_approver_or_reviewer_permission)
+                permission=approve_final_report_permission)
     def reject_report(self):
         pass
 

src/etools/applications/field_monitoring/planning/tests/test_views.py

@@ -667,17 +667,36 @@ def test_complete_reviewed_by_set(self):
         activity = MonitoringActivityFactory(monitor_type='staff', status='submitted')
         approver = UserFactory(approver=True)
 
-        response = self._test_retrieve(approver, activity)
-        # check transitions exists
-        self.assertListEqual(
-            [t['transition'] for t in response.data['transitions']],
-            ['complete', 'reject_report'])
+        details_response = self._test_retrieve(approver, activity)
+        self.assertEqual(
+            ['complete', 'reject_report'],
+            [t['transition'] for t in details_response.data['transitions']],
+        )
 
         self.assertIsNone(activity.reviewed_by)
         self._test_update(approver, activity, {'status': 'completed'})
         activity.refresh_from_db()
         self.assertEqual(activity.reviewed_by, approver)
 
+    @override_settings(UNICEF_USER_EMAIL="@example.com")
+    def test_complete_by_visit_lead(self):
+        approver = UserFactory(approver=True)
+        activity = MonitoringActivityFactory(monitor_type='staff', status='submitted', visit_lead=approver)
+
+        details_response = self._test_retrieve(approver, activity)
+        self.assertEqual(
+            [],
+            [t['transition'] for t in details_response.data['transitions']],
+        )
+
+        self._test_update(
+            approver,
+            activity,
+            {'status': 'completed'},
+            expected_status=status.HTTP_400_BAD_REQUEST,
+            basic_errors=['generic_transition_fail']
+        )
+
     @override_settings(UNICEF_USER_EMAIL="@example.com")
     def test_complete_by_report_reviewer(self):
         report_reviewer = UserFactory(unicef_user=True)

src/etools/applications/field_monitoring/planning/transitions/permissions.py

@@ -13,3 +13,7 @@ def user_is_visit_lead_permission(activity, user):
 def user_is_pme_or_approver_or_reviewer_permission(activity, user):
     return user.groups.filter(name__in=[PME.name, MonitoringVisitApprover.name]).exists() \
         or user == activity.report_reviewer
+
+
+def approve_final_report_permission(activity, user):
+    return user_is_pme_or_approver_or_reviewer_permission(activity, user) and not user_is_visit_lead_permission(activity, user)