.

atlas/decorators.py

@@ -1,5 +1,5 @@
 from django.core.exceptions import PermissionDenied
-from .models import Case, Series
+from .models import Case, CaseCollection, Series
 
 
 def user_is_author_or_atlas_series_checker_or_atlas_marker(function):
@@ -71,6 +71,22 @@ def user_is_author_or_atlas_editor(function):
     wrap.__name__ = function.__name__
     return wrap
 
+def user_is_collection_author_or_atlas_editor(function):
+    def wrap(request, *args, **kwargs):
+        atlas = CaseCollection.objects.get(pk=kwargs["pk"])
+        if (
+            request.user in atlas.author.all()
+            or request.user.groups.filter(name="atlas_editor").exists()
+            or request.user.is_superuser
+        ):
+            return function(request, *args, **kwargs)
+        else:
+            raise PermissionDenied
+
+    wrap.__doc__ = function.__doc__
+    wrap.__name__ = function.__name__
+    return wrap
+
 
 def user_is_atlas_editor(function):
     def wrap(request, *args, **kwargs):

atlas/views.py

@@ -93,6 +93,7 @@ from .decorators import (
     user_is_author_or_atlas_series_checker,
     user_is_atlas_marker,
     user_is_author_or_atlas_editor_or_atlas_marker,
+    user_is_collection_author_or_atlas_editor,
 )
 
 from collections import defaultdict
@@ -1057,7 +1058,7 @@ class CollectionView(LoginRequiredMixin, SingleTableMixin, FilterView):
     filterset_class = CaseCollectionFilter
 
 
-@user_is_author_or_atlas_editor
+@user_is_collection_author_or_atlas_editor
 def collection_detail(request, pk):
     collection = get_object_or_404(CaseCollection, pk=pk)
 
@@ -1072,7 +1073,7 @@ def collection_take(request, pk):
         request, "atlas/collection_take.html", {"collection": collection}
     )
 
-@user_is_author_or_atlas_editor
+@user_is_collection_author_or_atlas_editor
 def collection_mark_cid(request, pk):
     collection = get_object_or_404(CaseCollection, pk=pk)
 
@@ -1080,7 +1081,7 @@ def collection_mark_cid(request, pk):
         request, "atlas/collection_take.html", {"collection": collection}
     )
 
-@user_is_author_or_atlas_editor
+@user_is_collection_author_or_atlas_editor
 def collection_scores_cid(request, pk):
     collection = get_object_or_404(CaseCollection, pk=pk)
 
@@ -1088,7 +1089,7 @@ def collection_scores_cid(request, pk):
         request, "atlas/collection_take.html", {"collection": collection}
     )
 
-@user_is_author_or_atlas_editor
+@user_is_collection_author_or_atlas_editor
 def collection_candidates(request, pk):
     collection = get_object_or_404(CaseCollection, pk=pk)