Implement user group management with toggle functionality for superusers

generic/templates/generic/partials/user_groups_fragment.html

@@ -0,0 +1,48 @@
+{% load i18n %}
+<div id="user-groups-{{ user.pk }}">
+    <div class="d-flex flex-wrap gap-2 align-items-center">
+        {% if user.user_groups.all %}
+            {% for group in user.user_groups.all %}
+                {% if request.user.is_superuser %}
+                    <button
+                        class="btn btn-sm btn-outline-secondary"
+                        hx-post="{% url 'generic:user_toggle_group' user.pk group.pk %}"
+                        hx-target="#user-groups-{{ user.pk }}"
+                        hx-swap="outerHTML"
+                    >
+                        {{ group.name }}
+                        <span class="ms-1 text-muted small">&times;</span>
+                    </button>
+                {% else %}
+                    <a class="btn btn-sm btn-outline-secondary" href="{% url 'generic:user_group_detail' group.pk %}">{{ group.name }}</a>
+                {% endif %}
+            {% endfor %}
+        {% else %}
+            <div class="text-muted">No groups.</div>
+        {% endif %}
+
+        {% if request.user.is_superuser %}
+            {% if available_groups.count %}
+                <div class="dropdown">
+                    <button class="btn btn-sm btn-outline-primary dropdown-toggle" type="button" id="addGroupDropdown" data-bs-toggle="dropdown" aria-expanded="false">
+                        Add group
+                    </button>
+                    <ul class="dropdown-menu" aria-labelledby="addGroupDropdown">
+                        {% for ag in available_groups %}
+                            <li>
+                                <button
+                                    class="dropdown-item"
+                                    hx-post="{% url 'generic:user_toggle_group' user.pk ag.pk %}"
+                                    hx-target="#user-groups-{{ user.pk }}"
+                                    hx-swap="outerHTML"
+                                >
+                                    {{ ag.name }}
+                                </button>
+                            </li>
+                        {% endfor %}
+                    </ul>
+                </div>
+            {% endif %}
+        {% endif %}
+    </div>
+</div>

generic/urls.py

@@ -182,6 +182,11 @@ urlpatterns = [
         views.UserUserGroupCreate.as_view(),
         name="user_group_create",
     ),
+    path(
+        "user/<int:user_id>/toggle_group/<int:group_id>/",
+        views.user_toggle_group,
+        name="user_toggle_group",
+    ),
     path("cids/create", views.manage_cid_users, name="manage_cid_users"),
     path("cids/<int:cid>/details", views.cid_details, name="cid_details"),
     path("cids/create/email", views.create_cid_email, name="create_cid_email"),

generic/views.py

@@ -49,6 +49,7 @@ from reversion.views import RevisionMixin
 from atlas.models import CaseCollection, CaseDetail
 from generic.decorators import user_is_cid_user_manager
 from generic.filters import CidUserFilter, ExaminationFilter, SupervisorFilter
+from generic.models import UserUserGroup
 
 from generic.tables import (
     CidUserExamTable,
@@ -3876,6 +3877,39 @@ def user_group_view_all(request):
     )
 
 
+@login_required
+def user_toggle_group(request, user_id, group_id):
+    """Toggle membership of a user in a UserUserGroup.
+
+    This endpoint is superuser-only. It toggles membership and returns the
+    rendered groups fragment for the user so the frontend can swap it in.
+    """
+    if request.method != "POST":
+        return HttpResponse("Method not allowed", status=405)
+
+    if not request.user.is_superuser:
+        return HttpResponse("Forbidden", status=403)
+
+    user = get_object_or_404(User, pk=user_id)
+    group = get_object_or_404(UserUserGroup, pk=group_id)
+
+    # Toggle membership
+    if group.users.filter(pk=user.pk).exists():
+        group.users.remove(user)
+    else:
+        group.users.add(user)
+
+    # Return the updated groups fragment (outerHTML replacement)
+    available_groups = UserUserGroup.objects.filter(archive=False).exclude(
+        pk__in=user.user_groups.values_list("pk", flat=True)
+    )
+    return render(
+        request,
+        "generic/partials/user_groups_fragment.html",
+        {"user": user, "available_groups": available_groups},
+    )
+
+
 @login_required
 @user_is_cid_user_manager
 def group_email_resend(request, pk):