@require_objs_permissions_for_view(
    perm_names=["can_add_aggregates"],
    permittee_func=get_user_from_req,
    target_func=get_queryset(Project, "proj_id"),
)
def add_aggregate(request, proj_id):
    '''Add/remove aggregates to/from a project'''
    
    project = get_object_or_404(Project, id=proj_id)
    aggregate_list = Aggregate.objects.exclude(
        id__in=project.aggregates.all().values_list("id", flat=True))
    
    if request.method == "GET":
        return simple.direct_to_template(
            request, template=TEMPLATE_PATH+"/add_aggregates.html",
            extra_context={
                "aggregate_list": aggregate_list,
                "project": project,
                "breadcrumbs": (
                    ("Home", reverse("home")),
                    ("Project %s" % project.name, reverse("project_detail", args=[project.id])),
                    ("Add Project Aggregates", request.path),
                ),
            }
        )
    
    elif request.method == "POST":
        # check which submit button was pressed
        try:
            agg_id = int(request.POST.get("id", 0))
        except ValueError:
            raise Http404

        if aggregate_list.values_list("id", flat=True) not in agg_id:
            raise Http404

        aggregate = get_object_or_404(Aggregate, id=agg_id).as_leaf_class()

        #Look for the users in the project and give them permission to use the new AM.
        for member in project.members.exclude(is_superuser=True):
            #if not has_permission(member, project, "can_delete_slices"):
            give_permission_to("can_use_aggregate", aggregate, member, giver=None, can_delegate=False)

        return HttpResponseRedirect(aggregate.add_to_project(
            project, reverse("project_add_agg", args=[proj_id])))
    else:
        return HttpResponseNotAllowed("GET", "POST")
dataset/ETHPy150Open fp7-ofelia/ocf/expedient/src/python/expedient/clearinghouse/project/views.py/add_aggregate/swapped operands of `not in`