From 8806e48eb29b3f49355b36fa91fe577554d90a6c Mon Sep 17 00:00:00 2001
From: Ross <xkjq@ymail.com>
Date: Tue, 29 Jul 2025 09:40:19 +0100
Subject: [PATCH] Add open access management buttons and views for cases

---
 atlas/templates/atlas/case_view.html | 19 +++++++++++
 atlas/urls.py                        |  2 ++
 atlas/views.py                       | 48 ++++++++++++++++++++++++++++
 3 files changed, 69 insertions(+)

diff --git a/atlas/templates/atlas/case_view.html b/atlas/templates/atlas/case_view.html
index 1c8e9c66..d1c83a98 100755
--- a/atlas/templates/atlas/case_view.html
+++ b/atlas/templates/atlas/case_view.html
@@ -53,6 +53,25 @@
             >
             Remove selected cases from collection
         </button>
+        <br/>
+        <button id="set-open-access-btn"
+            class="btn btn-sm btn-outline-success ms-2"
+            hx-post="{% url 'atlas:set_open_access' %}"
+            hx-include="[name='selection']:checked"
+            hx-target="#action-result"
+            hx-swap="innerHTML"
+            >
+            Set Open Access
+        </button>
+        <button id="remove-open-access-btn"
+            class="btn btn-sm btn-outline-warning ms-2"
+            hx-post="{% url 'atlas:remove_open_access' %}"
+            hx-include="[name='selection']:checked"
+            hx-target="#action-result"
+            hx-swap="innerHTML"
+            >
+            Remove Open Access
+        </button>
         <span id="action-result"></span>
     </div>
 </div>
diff --git a/atlas/urls.py b/atlas/urls.py
index 5c37a43f..277cc46c 100755
--- a/atlas/urls.py
+++ b/atlas/urls.py
@@ -111,6 +111,8 @@ urlpatterns = [
         views.remove_cases_from_collection,
         name="remove_cases_from_collection",
     ),
+    path("case/set_open_access", views.set_open_access, name="set_open_access"),
+    path("case/remove_open_access", views.remove_open_access, name="remove_open_access"),
     path(
         "collection/options",
         views.collection_options,
diff --git a/atlas/views.py b/atlas/views.py
index ce4fab4c..2ddef069 100755
--- a/atlas/views.py
+++ b/atlas/views.py
@@ -674,6 +674,51 @@ def add_cases_to_collection(request):
         collection.cases.add(case_)
     return HttpResponse(f"Added {len(cases)} cases to collection {collection.name} (refresh to see)")
 
+@login_required
+def set_open_access(request):
+    if not request.htmx:
+        return Http404
+
+    case_ids = request.POST.getlist("selection")
+    if not case_ids:
+        return HttpResponse("No case ID(s) provided.")
+
+    cases = Case.objects.filter(pk__in=case_ids)
+
+    for case in cases:
+        # This will not let give accurate permission errors if the user does not have permission to edit any of the cases
+        # but it is simpler to just check the first case.
+        if not case.check_user_can_edit(request.user):
+            return HttpResponse(f"You do not have permission to set case {case.name} as open access.")
+
+        case.open_access = True
+        case.save()
+
+    return HttpResponse(f"Cases {', '.join([case.title for case in cases])} set to open access (refresh to see changes).")
+
+@login_required
+def remove_open_access(request):
+    if not request.htmx:
+        return Http404
+
+    case_ids = request.POST.getlist("selection")
+    if not case_ids:
+        return HttpResponse("No case ID(s) provided.")
+
+    cases = Case.objects.filter(pk__in=case_ids)
+
+    for case in cases:
+        # This will not let give accurate permission errors if the user does not have permission to edit any of the cases
+        # but it is simpler to just check the first case.
+        if not case.check_user_can_edit(request.user):
+            return HttpResponse(f"You do not have permission to remove open access from case {case.name}.")
+
+        case.open_access = False
+        case.save()
+
+    return HttpResponse(f"Cases {', '.join([case.title for case in cases])} removed from open access (refresh to see changes).")
+
+
 def add_case_to_collection(request, collection_id):
     if not request.htmx:
         return Http404
@@ -682,9 +727,12 @@ def add_case_to_collection(request, collection_id):
 
     if request.method == "POST":
         case = get_object_or_404(Case, pk=request.POST["case"])
+        if request.user not in collection.author.all():
+            return HttpResponse("You do not have permission to add cases to this collection.")
 
         if case in collection.cases.all():
             return HttpResponse("Case already in collection")
+
         print(case)
         collection.add_case(case)
         return HttpResponse(f"Case added to collection {collection.name} (refresh to see)")