ross/penracourses
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Refactor permission checks for marking cases as normal to use can_edit method

Browse Source
This commit is contained in:
Ross
2026-02-02 10:23:46 +00:00
parent 5e14df4836
commit 16865fab03
2 changed files with 15 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
atlas/templates/atlas/partials/_normal_toggle.html
+2 -2
View File
@@ -4,7 +4,7 @@
{% if case.normal_case %} {% if case.normal_case %}
<span class="badge bg-success">Normal</span> <span class="badge bg-success">Normal</span>
<small class="text-muted">{{ case.normal_case.display_age }}</small> <small class="text-muted">{{ case.normal_case.display_age }}</small>
{% if can_mark_normal %} {% if can_edit %}
<button class="btn btn-sm btn-outline-danger ms-2" <button class="btn btn-sm btn-outline-danger ms-2"
hx-post="{% url 'atlas:case_toggle_normal' case.pk %}" hx-post="{% url 'atlas:case_toggle_normal' case.pk %}"
hx-target="#normal-toggle-block" hx-target="#normal-toggle-block"
@@ -14,7 +14,7 @@
</button> </button>
{% endif %} {% endif %}
{% else %} {% else %}
{% if can_mark_normal %} {% if can_edit %}
<button class="btn btn-sm btn-outline-primary" <button class="btn btn-sm btn-outline-primary"
hx-get="{% url 'atlas:case_normal_form' case.pk %}" hx-get="{% url 'atlas:case_normal_form' case.pk %}"
hx-target="body" hx-target="body"
atlas/views.py
+13 -25
View File
@@ -564,9 +564,6 @@ def case_detail(request, pk):
case = get_case_for_case_detail(pk) case = get_case_for_case_detail(pk)
can_edit = case.check_user_can_edit(request.user) can_edit = case.check_user_can_edit(request.user)
is_atlas_editor = request.user.is_superuser or request.user.groups.filter(name="atlas_editor").exists()
is_case_author = case.author.filter(id=request.user.id).exists()
can_mark_normal = is_atlas_editor or is_case_author or request.user.is_superuser
return render( return render(
request, request,
@@ -575,9 +572,6 @@ def case_detail(request, pk):
"case": case, "case": case,
"cimar_sid": request.user.userprofile.cimar_sid, "cimar_sid": request.user.userprofile.cimar_sid,
"can_edit": can_edit, "can_edit": can_edit,
"is_atlas_editor": is_atlas_editor,
"is_case_author": is_case_author,
"can_mark_normal": can_mark_normal,
# Provide helper lists for resource search filters # Provide helper lists for resource search filters
"site_queryset": Site.objects.all(), "site_queryset": Site.objects.all(),
"subspecialty_queryset": Subspecialty.objects.all(), "subspecialty_queryset": Subspecialty.objects.all(),
@@ -596,11 +590,9 @@ def toggle_case_normal(request, pk):
""" """
case = get_case_for_case_detail(pk) case = get_case_for_case_detail(pk)
# Permission: atlas editors, case authors, or superusers # Permission: rely on `can_edit` check on the Case model
is_atlas_editor = request.user.is_superuser or request.user.groups.filter(name="atlas_editor").exists() can_edit = case.check_user_can_edit(request.user)
is_case_author = case.author.filter(id=request.user.id).exists() if not can_edit:
can_mark_normal = is_atlas_editor or is_case_author or request.user.is_superuser
if not can_mark_normal:
return HttpResponse(status=403) return HttpResponse(status=403)
# If already marked normal, unmark (delete the NormalCase) # If already marked normal, unmark (delete the NormalCase)
@@ -684,10 +676,10 @@ def toggle_case_normal(request, pk):
# Recompute flags for the fragment render # Recompute flags for the fragment render
is_atlas_editor = request.user.is_superuser or request.user.groups.filter(name="atlas_editor").exists() is_atlas_editor = request.user.is_superuser or request.user.groups.filter(name="atlas_editor").exists()
is_case_author = case.author.filter(id=request.user.id).exists() is_case_author = case.author.filter(id=request.user.id).exists()
can_mark_normal = is_atlas_editor or is_case_author or request.user.is_superuser can_edit = case.check_user_can_edit(request.user)
html = render_to_string( html = render_to_string(
"atlas/partials/_normal_toggle.html", "atlas/partials/_normal_toggle.html",
{"case": case, "user": request.user, "is_atlas_editor": is_atlas_editor, "is_case_author": is_case_author, "can_mark_normal": can_mark_normal}, {"case": case, "user": request.user, "is_atlas_editor": is_atlas_editor, "is_case_author": is_case_author, "can_edit": can_edit},
request=request, request=request,
) )
return HttpResponse(html) return HttpResponse(html)
@@ -698,11 +690,9 @@ def case_normal_form(request, pk):
"""Return an HTMX modal with a NormalCaseForm prepopulated with auto-extracted values.""" """Return an HTMX modal with a NormalCaseForm prepopulated with auto-extracted values."""
case = get_case_for_case_detail(pk) case = get_case_for_case_detail(pk)
# Permission check: allow atlas editors, case authors, or superusers # Permission check: rely on `can_edit` helper on the Case model
is_atlas_editor = request.user.is_superuser or request.user.groups.filter(name="atlas_editor").exists() can_edit = case.check_user_can_edit(request.user)
is_case_author = case.author.filter(id=request.user.id).exists() if not can_edit:
can_mark_normal = is_atlas_editor or is_case_author or request.user.is_superuser
if not can_mark_normal:
return HttpResponse(status=403) return HttpResponse(status=403)
# Extract defaults # Extract defaults
@@ -794,11 +784,9 @@ def case_normal_form(request, pk):
def create_case_normal(request, pk): def create_case_normal(request, pk):
case = get_case_for_case_detail(pk) case = get_case_for_case_detail(pk)
# Permission check: allow atlas editors, case authors, or superusers # Permission check: rely on `can_edit` helper on the Case model
is_atlas_editor = request.user.is_superuser or request.user.groups.filter(name="atlas_editor").exists() can_edit = case.check_user_can_edit(request.user)
is_case_author = case.author.filter(id=request.user.id).exists() if not can_edit:
can_mark_normal = is_atlas_editor or is_case_author or request.user.is_superuser
if not can_mark_normal:
return HttpResponse(status=403) return HttpResponse(status=403)
from .forms import NormalCaseForm from .forms import NormalCaseForm
@@ -824,10 +812,10 @@ def create_case_normal(request, pk):
# Return the updated toggle fragment and close modal via inline script # Return the updated toggle fragment and close modal via inline script
is_atlas_editor = request.user.is_superuser or request.user.groups.filter(name="atlas_editor").exists() is_atlas_editor = request.user.is_superuser or request.user.groups.filter(name="atlas_editor").exists()
is_case_author = case.author.filter(id=request.user.id).exists() is_case_author = case.author.filter(id=request.user.id).exists()
can_mark_normal = is_atlas_editor or is_case_author or request.user.is_superuser can_edit = case.check_user_can_edit(request.user)
toggle_html = render_to_string( toggle_html = render_to_string(
"atlas/partials/_normal_toggle.html", "atlas/partials/_normal_toggle.html",
{"case": case, "user": request.user, "is_atlas_editor": is_atlas_editor, "is_case_author": is_case_author, "can_mark_normal": can_mark_normal}, {"case": case, "user": request.user, "is_atlas_editor": is_atlas_editor, "is_case_author": is_case_author, "can_edit": can_edit},
request=request, request=request,
) )
toggle_html += "<script>var m = bootstrap.Modal.getOrCreateInstance(document.getElementById('normal-modal-{}')); if(m) m.hide();</script>".format(case.pk) toggle_html += "<script>var m = bootstrap.Modal.getOrCreateInstance(document.getElementById('normal-modal-{}')); if(m) m.hide();</script>".format(case.pk)