Restrcting the AccessPolicy options allowed during the project setup (#…

…2204)

Why this is required:

- HDN does not support `Open` as one of the access policies, and hence
ideally, it should not show up as one of the options allowed for the
user to choose during the set-up of the project.

What this PR does:

- Since the AccessPolicy names are strictly typed at a lot of places,
and the access is based on the Integer comparisons, it is hard to remove
the OPEN option as a part of the AccessPolicy class.
- This PR modifies the AccessMetadataForm to restrict the choices
available based on the environment variable `ALLOWED_ACCESS_POLICIES`,
which has a default value set as the 4 available options, if the
environment variable is not specified.

physionet-django/physionet/settings/base.py

@@ -663,3 +663,8 @@ class StorageTypes:
 
 # Emails
 PROJECT_EDITOR_EMAIL = config('PROJECT_EDITOR_EMAIL', default='')
+
+ALLOWED_ACCESS_POLICIES = config(
+    'ALLOWED_ACCESS_POLICIES',
+    default='OPEN,RESTRICTED,CREDENTIALED,CONTRIBUTOR_REVIEW'
+).split(',')

physionet-django/project/forms.py

@@ -876,6 +876,12 @@ def __init__(self, *args, **kwargs):
         if not settings.ENABLE_FILE_DOWNLOADS_OPTION:
             del self.fields['allow_file_downloads']
 
+        if settings.ALLOWED_ACCESS_POLICIES:
+            self.fields['access_policy'].choices = [
+                (value, label) for (value, label) in AccessPolicy.choices()
+                if AccessPolicy(value).name in settings.ALLOWED_ACCESS_POLICIES
+            ]
+
         if self.access_policy is None:
             self.access_policy = self.instance.access_policy