From a304c0b4dc554ed1ab6d09d379d934a230a6933b Mon Sep 17 00:00:00 2001
From: Ross <xkjq@ymail.com>
Date: Mon, 29 Jul 2024 13:05:09 +0100
Subject: [PATCH] some reset ansnwer improvements

---
 atlas/templates/atlas/collection_detail.html         |  2 ++
 generic/templates/generic/exam_overview_headers.html |  1 +
 generic/views.py                                     | 11 ++++++-----
 3 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/atlas/templates/atlas/collection_detail.html b/atlas/templates/atlas/collection_detail.html
index f81c9926..af3d440f 100644
--- a/atlas/templates/atlas/collection_detail.html
+++ b/atlas/templates/atlas/collection_detail.html
@@ -56,6 +56,8 @@
 
             <button title="This will clear all user answers and attempts"
             hx-post="{% url 'atlas:collection_reset_answers' collection.pk %}"
+            hx-swap="outerHTML"
+            hx-confirm="Are you sure you want to reset all answers? This action cannot be undone."
             >Reset all answers</button>
             
         </details>
diff --git a/generic/templates/generic/exam_overview_headers.html b/generic/templates/generic/exam_overview_headers.html
index 6252c11a..296fff83 100644
--- a/generic/templates/generic/exam_overview_headers.html
+++ b/generic/templates/generic/exam_overview_headers.html
@@ -49,6 +49,7 @@ Exam mode: {{ exam.exam_mode }}<br />
     <button title="This will clear all user answers and attempts"
     hx-post="{% url exam.get_app_name|add:':exam_reset_answers' exam.pk %}"
     hx-swap="outerHTML"
+    hx-confirm="Are you sure you want to reset all answers? This action cannot be undone."
     >Reset all answers</button>
     
 </details>
diff --git a/generic/views.py b/generic/views.py
index cd4e16b2..62dd11d0 100644
--- a/generic/views.py
+++ b/generic/views.py
@@ -502,7 +502,10 @@ class ExamViews(View, LoginRequiredMixin):
         # If a user is an exam author they should have acccess
         if exam_id is not None:
             exam = get_object_or_404(self.Exam, pk=exam_id)
-            if exam.open_access or user in exam.get_author_objects():
+            # Remove open_access check for the momement
+            #if exam.open_access or user in exam.get_author_objects():
+            #    return True
+            if user in exam.get_author_objects():
                 return True
 
             if exam.authors_only:
@@ -1046,10 +1049,8 @@ class ExamViews(View, LoginRequiredMixin):
         if request.htmx:
             exam = get_object_or_404(self.Exam, pk=exam_id)
 
-            if not request.user.groups.filter(name="cid_user_manager").exists():
-                # raise PermissionDenied
-                if request.user not in exam.author.all():
-                    raise PermissionDenied
+            if not self.check_user_edit_access(request.user, exam_id):
+                raise PermissionDenied
 
             ## Delete all answers
             exam.cid_user_answers.all().delete()