Hide Attract links & project settings for non-attract-users

attract/routes.py

@@ -171,6 +171,9 @@ def project_settings(project: pillarsdk.Project, **template_args: dict):
 
     from . import EXTENSION_NAME
 
+    if not current_attract.auth.current_user_is_attract_user():
+        raise wz_exceptions.Forbidden()
+
     # Based on the project state, we can render a different template.
     if not current_attract.is_attract_project(project):
         return render_template('attract/project_settings/offer_setup.html',