ross/penracourses
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Refactor permission checks for marking cases as normal to use can_edit method

Browse Source
This commit is contained in:
Ross
2026-02-02 10:23:46 +00:00
parent 5e14df4836
commit 16865fab03
2 changed files with 15 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
atlas/templates/atlas/partials/_normal_toggle.html
+2 -2
View File
@@ -4,7 +4,7 @@
{% if case.normal_case %}
<span class="badge bg-success">Normal</span>
<small class="text-muted">{{ case.normal_case.display_age }}</small>
{% if can_mark_normal %}
{% if can_edit %}
<button class="btn btn-sm btn-outline-danger ms-2"
hx-post="{% url 'atlas:case_toggle_normal' case.pk %}"
hx-target="#normal-toggle-block"
@@ -14,7 +14,7 @@
</button>
{% endif %}
{% else %}
{% if can_mark_normal %}
{% if can_edit %}
<button class="btn btn-sm btn-outline-primary"
hx-get="{% url 'atlas:case_normal_form' case.pk %}"
hx-target="body"
atlas/views.py
+13 -25
View File
@@ -564,9 +564,6 @@ def case_detail(request, pk):
case = get_case_for_case_detail(pk)
can_edit = case.check_user_can_edit(request.user)
is_atlas_editor = request.user.is_superuser or request.user.groups.filter(name="atlas_editor").exists()
is_case_author = case.author.filter(id=request.user.id).exists()
can_mark_normal = is_atlas_editor or is_case_author or request.user.is_superuser
return render(
request,
@@ -575,9 +572,6 @@ def case_detail(request, pk):
"case": case,
"cimar_sid": request.user.userprofile.cimar_sid,
"can_edit": can_edit,
"is_atlas_editor": is_atlas_editor,
"is_case_author": is_case_author,
"can_mark_normal": can_mark_normal,
# Provide helper lists for resource search filters
"site_queryset": Site.objects.all(),
"subspecialty_queryset": Subspecialty.objects.all(),
@@ -596,11 +590,9 @@ def toggle_case_normal(request, pk):
"""
case = get_case_for_case_detail(pk)
# Permission: atlas editors, case authors, or superusers
is_atlas_editor = request.user.is_superuser or request.user.groups.filter(name="atlas_editor").exists()
is_case_author = case.author.filter(id=request.user.id).exists()
can_mark_normal = is_atlas_editor or is_case_author or request.user.is_superuser
if not can_mark_normal:
# Permission: rely on `can_edit` check on the Case model
can_edit = case.check_user_can_edit(request.user)
if not can_edit:
return HttpResponse(status=403)
# If already marked normal, unmark (delete the NormalCase)
@@ -684,10 +676,10 @@ def toggle_case_normal(request, pk):
# Recompute flags for the fragment render
is_atlas_editor = request.user.is_superuser or request.user.groups.filter(name="atlas_editor").exists()
is_case_author = case.author.filter(id=request.user.id).exists()
can_mark_normal = is_atlas_editor or is_case_author or request.user.is_superuser
can_edit = case.check_user_can_edit(request.user)
html = render_to_string(
"atlas/partials/_normal_toggle.html",
{"case": case, "user": request.user, "is_atlas_editor": is_atlas_editor, "is_case_author": is_case_author, "can_mark_normal": can_mark_normal},
{"case": case, "user": request.user, "is_atlas_editor": is_atlas_editor, "is_case_author": is_case_author, "can_edit": can_edit},
request=request,
)
return HttpResponse(html)
@@ -698,11 +690,9 @@ def case_normal_form(request, pk):
"""Return an HTMX modal with a NormalCaseForm prepopulated with auto-extracted values."""
case = get_case_for_case_detail(pk)
# Permission check: allow atlas editors, case authors, or superusers
is_atlas_editor = request.user.is_superuser or request.user.groups.filter(name="atlas_editor").exists()
is_case_author = case.author.filter(id=request.user.id).exists()
can_mark_normal = is_atlas_editor or is_case_author or request.user.is_superuser
if not can_mark_normal:
# Permission check: rely on `can_edit` helper on the Case model
can_edit = case.check_user_can_edit(request.user)
if not can_edit:
return HttpResponse(status=403)
# Extract defaults
@@ -794,11 +784,9 @@ def case_normal_form(request, pk):
def create_case_normal(request, pk):
case = get_case_for_case_detail(pk)
# Permission check: allow atlas editors, case authors, or superusers
is_atlas_editor = request.user.is_superuser or request.user.groups.filter(name="atlas_editor").exists()
is_case_author = case.author.filter(id=request.user.id).exists()
can_mark_normal = is_atlas_editor or is_case_author or request.user.is_superuser
if not can_mark_normal:
# Permission check: rely on `can_edit` helper on the Case model
can_edit = case.check_user_can_edit(request.user)
if not can_edit:
return HttpResponse(status=403)
from .forms import NormalCaseForm
@@ -824,10 +812,10 @@ def create_case_normal(request, pk):
# Return the updated toggle fragment and close modal via inline script
is_atlas_editor = request.user.is_superuser or request.user.groups.filter(name="atlas_editor").exists()
is_case_author = case.author.filter(id=request.user.id).exists()
can_mark_normal = is_atlas_editor or is_case_author or request.user.is_superuser
can_edit = case.check_user_can_edit(request.user)
toggle_html = render_to_string(
"atlas/partials/_normal_toggle.html",
{"case": case, "user": request.user, "is_atlas_editor": is_atlas_editor, "is_case_author": is_case_author, "can_mark_normal": can_mark_normal},
{"case": case, "user": request.user, "is_atlas_editor": is_atlas_editor, "is_case_author": is_case_author, "can_edit": can_edit},
request=request,
)
toggle_html += "<script>var m = bootstrap.Modal.getOrCreateInstance(document.getElementById('normal-modal-{}')); if(m) m.hide();</script>".format(case.pk)