Restrict exam visibility in generic_exam_htmx based on user permissions

generic/views.py

@@ -585,7 +585,17 @@ def generic_exam_htmx(request):
         except Exception:
             return HttpResponse("Unknown type", status=400)
 
-        exams = Exam.objects.filter(archive=False).order_by("name")
+        # For non-superusers, only show exams they can edit or that they authored
+        if request.user.is_superuser:
+            exams = Exam.objects.filter(archive=False, exam_mode=True).order_by("name")
+        else:
+            # authors or markers or assigned exams
+            exams = (
+                Exam.objects.filter(author__id=request.user.id)
+                | Exam.objects.filter(markers__id=request.user.id)
+            )
+            exams = exams.filter(archive=False).order_by("name")
+
         return render(request, "generic/partials/exam_select_fragment.html", {"exams": exams, "type": question_type})
 
     if request.method == "POST":