Fix test failures: add staff_required decorator and update tests

- Add missing @staff_required decorator to homework_submissions view in cadmin
- Add missing @staff_required decorator to project_submissions view in cadmin
- Update redirect views in courses app to check staff status before redirecting
  - Non-staff users get error message and redirect to homework/project view
  - Staff users redirect to cadmin views
- Update test template expectations from homework/submissions.html to cadmin/homework_submissions.html
- Update test template expectations from projects/submissions.html to cadmin/project_submissions.html

Co-authored-by: alexeygrigorev <875246+alexeygrigorev@users.noreply.github.com>

Author: Copilot

courses/tests/test_homework.py

@@ -1597,7 +1597,7 @@ def test_submissions_view_admin_can_access(self):
         response = self.client.get(url)
 
         self.assertEqual(response.status_code, 200)
-        self.assertTemplateUsed(response, "homework/submissions.html")
+        self.assertTemplateUsed(response, "cadmin/homework_submissions.html")
 
         context = response.context
         self.assertEqual(context["course"], self.course)

courses/tests/test_project_submissions_view.py

@@ -136,7 +136,7 @@ def test_submissions_view_admin_can_access(self):
         response = self.client.get(url)
 
         self.assertEqual(response.status_code, 200)
-        self.assertTemplateUsed(response, "projects/submissions.html")
+        self.assertTemplateUsed(response, "cadmin/project_submissions.html")
 
         context = response.context
         self.assertEqual(context["course"], self.course)

courses/views/homework.py

@@ -424,7 +424,20 @@ def homework_statistics(request, course_slug, homework_slug):
 
 
 def homework_submissions(request, course_slug, homework_slug):
-    # Redirect to cadmin view
+    # Check if user is staff - if not, redirect to homework view with error
+    if not request.user.is_authenticated or not request.user.is_staff:
+        messages.error(
+            request,
+            "You do not have permission to view this page.",
+            extra_tags="homework",
+        )
+        return redirect(
+            "homework",
+            course_slug=course_slug,
+            homework_slug=homework_slug,
+        )
+    
+    # Staff users: redirect to cadmin view
     return redirect(
         "cadmin_homework_submissions",
         course_slug=course_slug,

courses/views/project.py

@@ -600,7 +600,20 @@ def project_statistics(request, course_slug, project_slug):
 
 
 def project_submissions(request, course_slug, project_slug):
-    # Redirect to cadmin view
+    # Check if user is staff - if not, redirect to project view with error
+    if not request.user.is_authenticated or not request.user.is_staff:
+        messages.error(
+            request,
+            "You do not have permission to view this page.",
+            extra_tags="project",
+        )
+        return redirect(
+            "project",
+            course_slug=course_slug,
+            project_slug=project_slug,
+        )
+    
+    # Staff users: redirect to cadmin view
     return redirect(
         "cadmin_project_submissions",
         course_slug=course_slug,