Require admin login for access code CSV import

TWLight/resources/admin.py

@@ -107,7 +107,7 @@ class AccessCodeAdmin(admin.ModelAdmin):
 
     def get_urls(self):
         urls = super(AccessCodeAdmin, self).get_urls()
-        my_urls = [path("import/", self.import_csv)]
+        my_urls = [path("import/", self.admin_site.admin_view(self.import_csv))]
         return my_urls + urls
 
     def import_csv(self, request):

TWLight/resources/tests.py

@@ -10,6 +10,7 @@
 from django.conf import settings
 from django.contrib.auth.models import AnonymousUser, User
 from django.core.exceptions import ValidationError, PermissionDenied
+from django.core.files.uploadedfile import SimpleUploadedFile
 from django.core.management import call_command
 from django.urls import reverse
 from django.db import IntegrityError
@@ -859,6 +860,41 @@ def test_csv_formatting(self):
         access_codes = AccessCode.objects.all()
         self.assertEqual(access_codes.count(), 0)
 
+    def _post_csv(self, client):
+        csv_file = SimpleUploadedFile(
+            "accesscodes.csv",
+            "ABCD-EFGH-IJKL,{pk}\n".format(pk=self.partner1_pk).encode("utf-8"),
+            content_type="text/csv",
+        )
+        return client.post(self.url, {"access_code_csv": csv_file})
+
+    def test_csv_upload_anonymous(self):
+        """
+        Logged out users should be redirected to the admin login page,
+        and shouldn't be able to upload anything.
+        """
+        client = Client()
+
+        response = self._post_csv(client)
+
+        self.assertEqual(response.status_code, 302)
+        self.assertIn(reverse("admin:login"), response.url)
+        self.assertEqual(AccessCode.objects.count(), 0)
+
+    def test_csv_upload_non_staff(self):
+        """
+        Logged in users who aren't staff should be redirected to the admin
+        login page, and shouldn't be able to upload anything.
+        """
+        client = Client()
+        client.force_login(self.user)
+
+        response = self._post_csv(client)
+
+        self.assertEqual(response.status_code, 302)
+        self.assertIn(reverse("admin:login"), response.url)
+        self.assertEqual(AccessCode.objects.count(), 0)
+
 
 class AutoWaitlistDisableTest(TestCase):
     @classmethod