Merged in [15683] and [15699] from housley@vigilsec.com:

Do not show reasons for review team member unavailability outside the team. Fixes ietf-tools#2614.
 - Legacy-Id: 15732
Note: SVN reference [15683] has been migrated to Git commit 6ff5526

Note: SVN reference [15699] has been migrated to Git commit 895aa0c

Author: levkowetz

hold-for-merge

@@ -1,7 +1,5 @@
 # -*- conf-mode -*-
 
-/personal/housley/6.87.4.dev0@15683	# Needs test fixed
-
 /personal/rcross/6.81.3.dev0@15262	# Secretariat admin access to Document has drawbacks
 /personal/sbirkholz/mtgreg3@14074	# reviewed with issues; feedback sent
 /personal/sbirkholz/meeting_registration@13969 # manual branch merge

ietf/group/tests_review.py

@@ -113,7 +113,7 @@ def test_reviewer_overview(self):
         reviewer = RoleFactory(name_id='reviewer',group=team,person__user__username='reviewer').person
         ReviewerSettingsFactory(person=reviewer,team=team)
         review_req1 = ReviewRequestFactory(state_id='completed',team=team,reviewer=reviewer.email())
-        RoleFactory(name_id='chair',person=reviewer,group=review_req1.doc.group)
+        PersonFactory(user__username='plain')
 
         ReviewRequest.objects.create(
             doc=review_req1.doc,
@@ -143,13 +143,30 @@ def test_reviewer_overview(self):
                     urlreverse(ietf.group.views.reviewer_overview, kwargs={ 'acronym': group.acronym, 'group_type': group.type_id })]:
             r = self.client.get(url)
             self.assertEqual(r.status_code, 200)
-            self.assertTrue(unicode(reviewer) in unicontent(r))
-            self.assertTrue(review_req1.doc.name in unicontent(r))
+            self.assertIn(unicode(reviewer), unicontent(r))
+            self.assertIn(review_req1.doc.name, unicontent(r))
+            # without a login, reason for being unavailable should not be seen
+            self.assertNotIn("Availability", unicontent(r))
+
+        url = urlreverse(ietf.group.views.reviewer_overview, kwargs={ 'acronym': group.acronym })
+        self.client.login(username="plain", password="plain+password")
+        r = self.client.get(url)
+        self.assertEqual(r.status_code, 200)
+        # not on review team, should not see reason for being unavailable
+        self.assertNotIn("Availability", unicontent(r))
+
+        self.client.login(username="reviewer", password="reviewer+password")
+        r = self.client.get(url)
+        self.assertEqual(r.status_code, 200)
+        # review team members can see reason for being unavailable
+        self.assertIn("Availability", unicontent(r))
 
         self.client.login(username="secretary", password="secretary+password")
         r = self.client.get(url)
         self.assertEqual(r.status_code, 200)
-        
+        # secretariat can see reason for being unavailable
+        self.assertIn("Availability", unicontent(r))
+
     def test_manage_review_requests(self):
         group = ReviewTeamFactory()
         reviewer = RoleFactory(name_id='reviewer',group=group,person__user__username='reviewer').person

ietf/group/views.py

@@ -1376,11 +1376,12 @@ def reviewer_overview(request, acronym, group_type=None):
             if group_type:
                 kwargs["group_type"] = group_type
             person.settings_url = urlreverse("ietf.group.views.change_reviewer_settings", kwargs=kwargs)
-        person.unavailable_periods = unavailable_periods.get(person.pk, [])
-        person.completely_unavailable = any(p.availability == "unavailable"
-                                       and (p.start_date is None or p.start_date <= today) and (p.end_date is None or today <= p.end_date)
-                                       for p in person.unavailable_periods)
-        person.busy = person.id in days_needed 
+        if can_access_review_stats_for_team(request.user, group):
+            person.unavailable_periods = unavailable_periods.get(person.pk, [])
+            person.completely_unavailable = any(p.availability == "unavailable"
+                                           and (p.start_date is None or p.start_date <= today) and (p.end_date is None or today <= p.end_date)
+                                           for p in person.unavailable_periods)
+            person.busy = person.id in days_needed 
 
 
         MAX_CLOSED_REQS = 10