dont let users submit work unless they've started work

app/app/pipeline.py

@@ -30,5 +30,8 @@ def save_profile(backend, user, response, request, *args, **kwargs):
         if handle in settings.BLOCKED_USERS:
             raise SuspiciousOperation('You cannot login')
 
+        if not user.active:
+            raise SuspiciousOperation('You cannot login')
+
         sync_profile(handle, user, hide_profile=False)
         setup_lang(request, user)

app/dashboard/models.py

@@ -480,6 +480,18 @@ def is_funder(self, handle):
         """
         return handle.lower().lstrip('@') == self.bounty_owner_github_username.lower().lstrip('@')
 
+    def has_started_work(self, handle, pending=False):
+        """Determine whether or not the profile has started work
+
+        Args:
+            handle (str): The profile handle to be compared.
+
+        Returns:
+            bool: Whether or not the user has started work.
+
+        """
+        return self.interested.filter(pending=pending, profile__handle=handle).exists()
+
     @property
     def absolute_url(self):
         return self.get_absolute_url()

app/dashboard/views.py

@@ -26,6 +26,7 @@
 from django.contrib import messages
 from django.contrib.auth.models import User
 from django.core.paginator import EmptyPage, PageNotAnInteger, Paginator
+from django.core.exceptions import PermissionDenied
 from django.db.models import Q
 from django.http import Http404, HttpResponse, JsonResponse
 from django.shortcuts import redirect
@@ -743,6 +744,8 @@ def fulfill_bounty(request):
 
     """
     bounty = handle_bounty_views(request)
+    if not bounty.has_started_work(request.user.username):
+        raise PermissionDenied
     params = get_context(
         ref_object=bounty,
         github_username=request.GET.get('githubUsername'),