From 793044302955f0d2d5154d8408c6438bb18ad43e Mon Sep 17 00:00:00 2001
From: Ross <xkjq@ymail.com>
Date: Sat, 2 Apr 2022 23:07:04 +0100
Subject: [PATCH] .

---
 atlas/decorators.py | 18 +++++++++++++++++-
 atlas/views.py      |  9 +++++----
 2 files changed, 22 insertions(+), 5 deletions(-)

diff --git a/atlas/decorators.py b/atlas/decorators.py
index ce6c9555..f7b3b31b 100755
--- a/atlas/decorators.py
+++ b/atlas/decorators.py
@@ -1,5 +1,5 @@
 from django.core.exceptions import PermissionDenied
-from .models import Case, Series
+from .models import Case, CaseCollection, Series
 
 
 def user_is_author_or_atlas_series_checker_or_atlas_marker(function):
@@ -71,6 +71,22 @@ def user_is_author_or_atlas_editor(function):
     wrap.__name__ = function.__name__
     return wrap
 
+def user_is_collection_author_or_atlas_editor(function):
+    def wrap(request, *args, **kwargs):
+        atlas = CaseCollection.objects.get(pk=kwargs["pk"])
+        if (
+            request.user in atlas.author.all()
+            or request.user.groups.filter(name="atlas_editor").exists()
+            or request.user.is_superuser
+        ):
+            return function(request, *args, **kwargs)
+        else:
+            raise PermissionDenied
+
+    wrap.__doc__ = function.__doc__
+    wrap.__name__ = function.__name__
+    return wrap
+
 
 def user_is_atlas_editor(function):
     def wrap(request, *args, **kwargs):
diff --git a/atlas/views.py b/atlas/views.py
index 4e667efd..c326e676 100755
--- a/atlas/views.py
+++ b/atlas/views.py
@@ -93,6 +93,7 @@ from .decorators import (
     user_is_author_or_atlas_series_checker,
     user_is_atlas_marker,
     user_is_author_or_atlas_editor_or_atlas_marker,
+    user_is_collection_author_or_atlas_editor,
 )
 
 from collections import defaultdict
@@ -1057,7 +1058,7 @@ class CollectionView(LoginRequiredMixin, SingleTableMixin, FilterView):
     filterset_class = CaseCollectionFilter
 
 
-@user_is_author_or_atlas_editor
+@user_is_collection_author_or_atlas_editor
 def collection_detail(request, pk):
     collection = get_object_or_404(CaseCollection, pk=pk)
 
@@ -1072,7 +1073,7 @@ def collection_take(request, pk):
         request, "atlas/collection_take.html", {"collection": collection}
     )
 
-@user_is_author_or_atlas_editor
+@user_is_collection_author_or_atlas_editor
 def collection_mark_cid(request, pk):
     collection = get_object_or_404(CaseCollection, pk=pk)
 
@@ -1080,7 +1081,7 @@ def collection_mark_cid(request, pk):
         request, "atlas/collection_take.html", {"collection": collection}
     )
 
-@user_is_author_or_atlas_editor
+@user_is_collection_author_or_atlas_editor
 def collection_scores_cid(request, pk):
     collection = get_object_or_404(CaseCollection, pk=pk)
 
@@ -1088,7 +1089,7 @@ def collection_scores_cid(request, pk):
         request, "atlas/collection_take.html", {"collection": collection}
     )
 
-@user_is_author_or_atlas_editor
+@user_is_collection_author_or_atlas_editor
 def collection_candidates(request, pk):
     collection = get_object_or_404(CaseCollection, pk=pk)