From 3b0b11d0697a148732998929bd4a30c763a369d5 Mon Sep 17 00:00:00 2001
From: Klaas van Schelven <klaas@vanschelven.com>
Date: Tue, 10 Sep 2024 08:48:46 +0200
Subject: [PATCH] Fix team creation permissions

settings.TEAM_CREATION was simply unused; an oversight.
---
 teams/templates/teams/team_list.html | 2 +-
 teams/views.py                       | 9 +++++++--
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/teams/templates/teams/team_list.html b/teams/templates/teams/team_list.html
index 609d4c1..12d0a32 100644
--- a/teams/templates/teams/team_list.html
+++ b/teams/templates/teams/team_list.html
@@ -15,7 +15,7 @@
 
     {# align to bottom #}
     <div class="ml-auto"><!-- top, RHS (buttons) -->
-        {% if perms.teams.add_team %}
+        {% if can_create %}
         <div>
             <a class="block font-bold text-slate-800 border-slate-500 pl-4 pr-4 pb-2 pt-2 ml-1 border-2 bg-cyan-200 hover:bg-cyan-400 active:ring rounded-md" href="{% url 'team_new' %}">New Team</a>
         </div>
diff --git a/teams/views.py b/teams/views.py
index 5c195ee..ac0bd78 100644
--- a/teams/views.py
+++ b/teams/views.py
@@ -8,7 +8,6 @@ from django.core.exceptions import PermissionDenied
 from django.utils import timezone
 from django.urls import reverse
 from django.contrib import messages
-from django.contrib.auth.decorators import permission_required
 from django.contrib.auth import logout
 
 from users.models import EmailVerification
@@ -83,14 +82,20 @@ def team_list(request, ownership_filter=None):
         team_list = team_list_2
 
     return render(request, 'teams/team_list.html', {
+        'can_create':
+            get_settings().TEAM_CREATION in [CB_ANYBODY, CB_MEMBERS] or
+            (request.user.is_superuser and get_settings().TEAM_CREATION == CB_ADMINS),
         'ownership_filter': ownership_filter,
         'team_list': team_list,
     })
 
 
 @atomic_for_request_method
-@permission_required("teams.add_team")
 def team_new(request):
+    if not (get_settings().TEAM_CREATION in [CB_ANYBODY, CB_MEMBERS] or
+            (request.user.is_superuser and get_settings().TEAM_CREATION == CB_ADMINS)):
+        raise PermissionDenied("You are not allowed to create teams")
+
     if request.method == 'POST':
         form = TeamForm(request.POST)