pull-requests: only allow actual reviewers to leave status/votes.

Other participants aren't allowed that, they could only sent text comments
to not distract from actual votes that count towards the overall review.

rhodecode/apps/repository/views/repo_commits.py

@@ -170,7 +170,6 @@ class RepoCommitsView(RepoAppView):
                     )
                     reviewers_duplicates.add(_user_id)
 
-            c.allowed_reviewers = reviewers
             c.reviewers_count = len(reviewers)
             c.observers_count = 0
 

rhodecode/apps/repository/views/repo_pull_requests.py

@@ -455,7 +455,6 @@ class RepoPullRequestsView(RepoAppView, DataGridAppView):
                 'rhodecode:templates/pullrequests/pullrequest_merge_checks.mako'
             return self._get_template_context(c)
 
-        c.allowed_reviewers = [obj.user_id for obj in pull_request.reviewers if obj.user]
         c.reviewers_count = pull_request.reviewers_count
         c.observers_count = pull_request.observers_count
 
@@ -761,7 +760,9 @@ class RepoPullRequestsView(RepoAppView, DataGridAppView):
 
             # current user review statuses for each version
             c.review_versions = {}
-            if self._rhodecode_user.user_id in c.allowed_reviewers:
+            is_reviewer = PullRequestModel().is_user_reviewer(
+                pull_request, self._rhodecode_user)
+            if is_reviewer:
                 for co in general_comments:
                     if co.author.user_id == self._rhodecode_user.user_id:
                         status = co.status_change

rhodecode/model/pull_request.py

@@ -288,10 +288,16 @@ class PullRequestModel(BaseModel):
         _perms = ('repository.admin',)
         return self._check_perms(_perms, pull_request, user) or owner
 
+    def is_user_reviewer(self, pull_request, user):
+        return user.user_id in [
+            x.user_id for x in
+            pull_request.get_pull_request_reviewers(PullRequestReviewers.ROLE_REVIEWER)
+            if x.user
+        ]
+
     def check_user_change_status(self, pull_request, user, api=False):
-        reviewer = user.user_id in [x.user_id for x in
-                                    pull_request.reviewers]
-        return self.check_user_update(pull_request, user, api) or reviewer
+        return self.check_user_update(pull_request, user, api) \
+               or self.is_user_reviewer(pull_request, user)
 
     def check_user_comment(self, pull_request, user):
         owner = user.user_id == pull_request.user_id