Add open access management buttons and views for cases

atlas/views.py

@@ -674,6 +674,51 @@ def add_cases_to_collection(request):
         collection.cases.add(case_)
     return HttpResponse(f"Added {len(cases)} cases to collection {collection.name} (refresh to see)")
 
+@login_required
+def set_open_access(request):
+    if not request.htmx:
+        return Http404
+
+    case_ids = request.POST.getlist("selection")
+    if not case_ids:
+        return HttpResponse("No case ID(s) provided.")
+
+    cases = Case.objects.filter(pk__in=case_ids)
+
+    for case in cases:
+        # This will not let give accurate permission errors if the user does not have permission to edit any of the cases
+        # but it is simpler to just check the first case.
+        if not case.check_user_can_edit(request.user):
+            return HttpResponse(f"You do not have permission to set case {case.name} as open access.")
+
+        case.open_access = True
+        case.save()
+
+    return HttpResponse(f"Cases {', '.join([case.title for case in cases])} set to open access (refresh to see changes).")
+
+@login_required
+def remove_open_access(request):
+    if not request.htmx:
+        return Http404
+
+    case_ids = request.POST.getlist("selection")
+    if not case_ids:
+        return HttpResponse("No case ID(s) provided.")
+
+    cases = Case.objects.filter(pk__in=case_ids)
+
+    for case in cases:
+        # This will not let give accurate permission errors if the user does not have permission to edit any of the cases
+        # but it is simpler to just check the first case.
+        if not case.check_user_can_edit(request.user):
+            return HttpResponse(f"You do not have permission to remove open access from case {case.name}.")
+
+        case.open_access = False
+        case.save()
+
+    return HttpResponse(f"Cases {', '.join([case.title for case in cases])} removed from open access (refresh to see changes).")
+
+
 def add_case_to_collection(request, collection_id):
     if not request.htmx:
         return Http404
@@ -682,9 +727,12 @@ def add_case_to_collection(request, collection_id):
 
     if request.method == "POST":
         case = get_object_or_404(Case, pk=request.POST["case"])
+        if request.user not in collection.author.all():
+            return HttpResponse("You do not have permission to add cases to this collection.")
 
         if case in collection.cases.all():
             return HttpResponse("Case already in collection")
+
         print(case)
         collection.add_case(case)
         return HttpResponse(f"Case added to collection {collection.name} (refresh to see)")