Enhance Supervisor Dashboard and Trainee Feedback Features

- Redesigned the supervisor overview page to include a header card with supervisor details and trainee statistics.
- Implemented a tabbed interface for viewing trainees and their recent attempts.
- Improved the trainee detail page with a profile card and a table for displaying attempt history.
- Added a new view for supervisors to provide feedback on case collections, including outstanding feedback items and previous conversations.
- Updated URL routing to support new feedback functionality.
- Enhanced backend logic to ensure proper sharing permissions for exam attempts and case collections.
- Added comprehensive tests for supervisor access to trainee data and feedback functionalities.

atlas/decorators.py

@@ -108,8 +108,29 @@ def user_is_collection_author_or_atlas_editor(function):
             or request.user.is_superuser
         ):
             return function(request, *args, **kwargs)
-        else:
-            raise PermissionDenied
+
+        # Allow access if request.user is the supervisor of the target user and sharing is enabled
+        user_pk = kwargs.get("user_pk") or kwargs.get("user_id")
+        if user_pk:
+            from django.contrib.auth import get_user_model
+            from django.contrib.contenttypes.models import ContentType
+            from generic.models import CidUserExam
+            try:
+                target_user = get_user_model().objects.get(pk=user_pk)
+                sup = target_user.userprofile.supervisor
+                if sup and sup.user_id == request.user.id:
+                    ct = ContentType.objects.get_for_model(CaseCollection)
+                    cid_user_exam = CidUserExam.objects.filter(
+                        content_type=ct,
+                        object_id=atlas.pk,
+                        user_user=target_user
+                    ).first()
+                    if (cid_user_exam and cid_user_exam.share_with_supervisor) or atlas.results_supervisor_visible:
+                        return function(request, *args, **kwargs)
+            except Exception:
+                pass
+
+        raise PermissionDenied
 
     wrap.__doc__ = function.__doc__
     wrap.__name__ = function.__name__