finish pinning down permissions, add redirect

beat/web/reports/views.py

@@ -25,7 +25,7 @@
 #                                                                             #
 ###############################################################################
 
-from django.shortcuts import render_to_response
+from django.shortcuts import render_to_response, redirect
 from django.shortcuts import get_object_or_404
 from django.template import RequestContext, Context
 from django.conf import settings
@@ -85,20 +85,30 @@ def for_author(request, author_name, report_name):
             name = report_name)
 
     isAuthor = request.user.username == obj.author.username
-
-    if not isAuthor:
-        # return 404
-        raise Http404('No %s matches the given query.' % Report._meta.object_name)
-
-    return render_to_response('reports/report.html',
-            {
-                'author'      : author_name,
-                'report_name' : report_name,
-                'owner'       : (request.user == obj.author),
-                'report'      : obj,
-                'USE_HTTPS_GRAVATAR': settings.USE_HTTPS_GRAVATAR,
-                },
-            context_instance=RequestContext(request))
+    isEditable = obj.status == 'E'
+    isPublished = obj.status == 'P'
+    isLocked = obj.status == 'L'
+
+    # if its the author and its locked, redirect to numbered url
+    # same if its published
+    if isPublished or (isAuthor and isLocked):
+        return redirect(obj)
+
+
+    # only valid when the author is accessing it and its editable
+    if isEditable and isAuthor:
+        return render_to_response('reports/report.html',
+                {
+                    'author'      : author_name,
+                    'report_name' : report_name,
+                    'owner'       : (request.user == obj.author),
+                    'report'      : obj,
+                    'USE_HTTPS_GRAVATAR': settings.USE_HTTPS_GRAVATAR,
+                    },
+                context_instance=RequestContext(request))
+
+    # return 404
+    raise Http404('No %s matches the given query.' % Report._meta.object_name)
 
 
 #------------------------------------------------