Add open access management buttons and views for cases

atlas/templates/atlas/case_view.html

@@ -53,6 +53,25 @@
             >
             Remove selected cases from collection
         </button>
+        <br/>
+        <button id="set-open-access-btn"
+            class="btn btn-sm btn-outline-success ms-2"
+            hx-post="{% url 'atlas:set_open_access' %}"
+            hx-include="[name='selection']:checked"
+            hx-target="#action-result"
+            hx-swap="innerHTML"
+            >
+            Set Open Access
+        </button>
+        <button id="remove-open-access-btn"
+            class="btn btn-sm btn-outline-warning ms-2"
+            hx-post="{% url 'atlas:remove_open_access' %}"
+            hx-include="[name='selection']:checked"
+            hx-target="#action-result"
+            hx-swap="innerHTML"
+            >
+            Remove Open Access
+        </button>
         <span id="action-result"></span>
     </div>
 </div>

atlas/urls.py

@@ -111,6 +111,8 @@ urlpatterns = [
         views.remove_cases_from_collection,
         name="remove_cases_from_collection",
     ),
+    path("case/set_open_access", views.set_open_access, name="set_open_access"),
+    path("case/remove_open_access", views.remove_open_access, name="remove_open_access"),
     path(
         "collection/options",
         views.collection_options,

atlas/views.py

@@ -674,6 +674,51 @@ def add_cases_to_collection(request):
         collection.cases.add(case_)
     return HttpResponse(f"Added {len(cases)} cases to collection {collection.name} (refresh to see)")
 
+@login_required
+def set_open_access(request):
+    if not request.htmx:
+        return Http404
+
+    case_ids = request.POST.getlist("selection")
+    if not case_ids:
+        return HttpResponse("No case ID(s) provided.")
+
+    cases = Case.objects.filter(pk__in=case_ids)
+
+    for case in cases:
+        # This will not let give accurate permission errors if the user does not have permission to edit any of the cases
+        # but it is simpler to just check the first case.
+        if not case.check_user_can_edit(request.user):
+            return HttpResponse(f"You do not have permission to set case {case.name} as open access.")
+
+        case.open_access = True
+        case.save()
+
+    return HttpResponse(f"Cases {', '.join([case.title for case in cases])} set to open access (refresh to see changes).")
+
+@login_required
+def remove_open_access(request):
+    if not request.htmx:
+        return Http404
+
+    case_ids = request.POST.getlist("selection")
+    if not case_ids:
+        return HttpResponse("No case ID(s) provided.")
+
+    cases = Case.objects.filter(pk__in=case_ids)
+
+    for case in cases:
+        # This will not let give accurate permission errors if the user does not have permission to edit any of the cases
+        # but it is simpler to just check the first case.
+        if not case.check_user_can_edit(request.user):
+            return HttpResponse(f"You do not have permission to remove open access from case {case.name}.")
+
+        case.open_access = False
+        case.save()
+
+    return HttpResponse(f"Cases {', '.join([case.title for case in cases])} removed from open access (refresh to see changes).")
+
+
 def add_case_to_collection(request, collection_id):
     if not request.htmx:
         return Http404
@@ -682,9 +727,12 @@ def add_case_to_collection(request, collection_id):
 
     if request.method == "POST":
         case = get_object_or_404(Case, pk=request.POST["case"])
+        if request.user not in collection.author.all():
+            return HttpResponse("You do not have permission to add cases to this collection.")
 
         if case in collection.cases.all():
             return HttpResponse("Case already in collection")
+
         print(case)
         collection.add_case(case)
         return HttpResponse(f"Case added to collection {collection.name} (refresh to see)")