Only return published blog entries.

[marksweb]

This fixes #1755 to only return published blog entries, even for staff users.

Unpublished entries can still be previewed via the admin.

[marksweb]

On a side note, my test suite is failing me and I'm not sure why.

======================================================================
ERROR: blog.tests (unittest.loader._FailedTest.blog.tests)
----------------------------------------------------------------------
ImportError: Failed to import test module: blog.tests
Traceback (most recent call last):
  File "/Users/mark/.local/share/uv/python/cpython-3.12.7-macos-aarch64-none/lib/python3.12/unittest/loader.py", line 396, in _find_test_path
    module = self._get_module_from_name(name)
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/Users/mark/.local/share/uv/python/cpython-3.12.7-macos-aarch64-none/lib/python3.12/unittest/loader.py", line 339, in _get_module_from_name
    __import__(name)
  File "/Users/mark/dev/djangoproject.com/blog/tests.py", line 2, in <module>
    from test.support import captured_stderr
ModuleNotFoundError: No module named 'test'

Discovered the reason for this; https://github.com/django/djangoproject.com/issues/1758

[jefftriplett]

@marksweb this is great. Thank you for jumping in on this.

[marksweb]

And there should also be some tests added (I'm suprised there weren't already

Yes I was surprised & expecting you to suggest this 😄

[marksweb]

Thanks for the quick response on this, nice work 👍🏻

If you allow me to change/extend the scope of this PR a little bit, I think it's not enough to test for user.is_staff but we should also make sure that the user has write permissions on the BlogEntry model (since this feature is meant to be used for previewing).

And there should also be some tests added (I'm suprised there weren't already, or that if there were they were still passing after this change):

* anon users can't see unpublished entries at all (list or detail)

* logged in users (non-staff) can't see unpublished entries at all

* staff users without write permission on `BlogEntry` can't see unpublished entries at all

* staff users with write permission on `BlogEntry` can't see unpublished entries in the list, but can view the detail page

Ok, it took longer than I expected, but I've added tests and enforced permissions.

[adamzap]

@marksweb Could you check the CI failure here?

[marksweb]

@marksweb Could you check the CI failure here?

Done - there was an actual issue I'd not spotted 🤦🏼

[adamzap]

@bmispelon Do you have any concerns here, or can we merge this?