course admin team: handle is_staff users

A user with `is_staff=True` is treated as being in all groups. This is problematic
when we care about the user's staff/instructor role for a course: you can't remove
the instructor role. This commit changes the `is_user_in_course_group_role` function
to allow the caller to specify that it should not check the `is_staff` attribute
on the user.

cms/djangoapps/auth/authz.py

@@ -178,10 +178,12 @@ def _remove_user_from_group(user, group_name):
     user.save()
 
 
-def is_user_in_course_group_role(user, location, role):
+def is_user_in_course_group_role(user, location, role, check_staff=True):
     if user.is_active and user.is_authenticated:
         # all "is_staff" flagged accounts belong to all groups
-        return user.is_staff or user.groups.filter(name=get_course_groupname_for_role(location, role)).count() > 0
+        if check_staff and user.is_staff:
+            return True
+        return user.groups.filter(name=get_course_groupname_for_role(location, role)).count() > 0
 
     return False
 

cms/templates/manage_users.html

@@ -59,7 +59,7 @@
             % if allow_actions:
             <div class="item-actions">
               % if request.user.id != user.id:
-                % if is_user_in_course_group_role(user, context_course.location, 'instructor'):
+                % if is_user_in_course_group_role(user, context_course.location, 'instructor', check_staff=False):
                      <% admin_class = "remove-admin" %>
                      <% admin_text = "Remove Admin" %>
                 % else: