Iss2205

[ybrnr]

fix #2205

[janno42]

Nice 👍

Please check the formatting

[Kakadus]

naturally, a test would be nice : )

Thanks!

[Kakadus]

I think this assertion is no longer needed

[richardebeling]

I'd move it up to line 33, where I think it would still add value.

The call graphs we can get now are a bit wonky. We can have
enter_staff_mode -> update_staff_mode -> finds out that not request.user.has_staff_permission -> exit_staff_mode and returns without exception, which is probably never what the initial caller intended?

It seems to me that update_staff_mode was about "update the timestamp in the session to now()" in the past, now it has changed semantics. Could use a little clean up in general, I think.

[richardebeling]

Blocking for missing test, since this is authorization logic and we discovered a code path in the issue that we considered not to happen naturally before. Feel free to assign the PR to me if you want me to write the test.