Use backend to enforce frozen accounts

kfet/auth/backends.py

@@ -1,4 +1,5 @@
 from django.contrib.auth import get_user_model
+from django.core.exceptions import PermissionDenied
 
 from kfet.models import Account, GenericTeamToken
 
@@ -37,3 +38,36 @@ class GenericBackend(BaseKFetBackend):
         team_token.delete()
 
         return get_kfet_generic_user()
+
+
+class BlockFrozenAccountBackend:
+    def authenticate(self, request, **kwargs):
+        return None
+
+    def get_user(self, user_id):
+        return None
+
+    def has_perm(self, user_obj, perm, obj=None):
+        app_label, _ = perm.split(".")
+        if app_label == "kfet":
+            if (
+                hasattr(user_obj, "profile")
+                and hasattr(user_obj.profile, "account_kfet")
+                and user_obj.profile.account_kfet.is_frozen
+            ):
+                raise PermissionDenied
+
+        # Dans le cas général, on se réfère aux autres backends
+        return False
+
+    def has_module_perms(self, user_obj, app_label):
+        if app_label == "kfet":
+            if (
+                hasattr(user_obj, "profile")
+                and hasattr(user_obj.profile, "account_kfet")
+                and user_obj.profile.account_kfet.is_frozen
+            ):
+                raise PermissionDenied
+
+        # Dans le cas général, on se réfère aux autres backends
+        return False

kfet/decorators.py

@@ -2,13 +2,6 @@ from django.contrib.auth.decorators import user_passes_test
 
 
 def kfet_is_team(user):
-    if (
-        hasattr(user, "profile")
-        and hasattr(user.profile, "account_kfet")
-        and user.profile.account_kfet.is_frozen
-    ):
-        return False
-
     return user.has_perm("kfet.is_team")