Enforce and test TODO_STAFF_ONLY setting

todo/views/toggle_done.py

@@ -1,5 +1,5 @@
 from django.contrib import messages
-from django.contrib.auth.decorators import login_required
+from django.contrib.auth.decorators import login_required, user_passes_test
 from django.core.exceptions import PermissionDenied
 from django.http import HttpResponse
 from django.shortcuts import get_object_or_404, redirect
@@ -7,9 +7,11 @@ from django.urls import reverse
 
 from todo.models import Task
 from todo.utils import toggle_task_completed
+from todo.utils import staff_check
 
 
 @login_required
+@user_passes_test(staff_check)
 def toggle_done(request, task_id: int) -> HttpResponse:
     """Toggle the completed status of a task from done to undone, or vice versa.
     Redirect to the list from which the task came.