tidy up the marker changes

generic/views.py

@@ -427,11 +427,14 @@ class ExamViews(View, LoginRequiredMixin):
         self.ExtraExamFilter = ExtraExamFilter
 
     # TODO: these may be better implemented as decorators
-    def check_user_access(self, user: User, exam_id: int = None):
+    def check_user_access(self, user: User, exam_id: int = None, marker=False):
         """Check if a user should be able to access a view
 
         Args:
             user ([user]): user object
+            exam_id ([int], optional): exam id. Defaults to None.
+
+            marker ([boolean], optional): Allow access if the user is a marker. Defaults to False. Requires that exam_id is set.
 
         Returns:
             [boolean]: True if the user has access
@@ -440,11 +443,18 @@ class ExamViews(View, LoginRequiredMixin):
         if user.is_superuser:
             return True
 
+        if marker and exam_id is None:
+            # raise error if exam_id is not provided
+            raise ValueError("exam_id must be provided if marker checking for a marker")
+
         if exam_id is not None:
-            exam = get_object_or_404(self.Exam, pk=exam_id)
+            exam: ExamBase = get_object_or_404(self.Exam, pk=exam_id)
             if (exam.open_access and exam.active) or user in exam.get_author_objects():
                 return True
 
+            if marker and user in exam.markers.all(): 
+                return True
+
             if exam.authors_only:
                 return False
 
@@ -487,6 +497,9 @@ class ExamViews(View, LoginRequiredMixin):
             return False
         return True
 
+    def check_user_marker_access(self, user: User, exam_id: int = None):
+        return self.check_user_access(user, exam_id, marker=True)
+
     def check_user_edit_access(self, user, exam_id=None):
         """Check if a user should be able to access a view
 
@@ -541,7 +554,7 @@ class ExamViews(View, LoginRequiredMixin):
             and not user.groups.filter(name="casecollection_checker").exists()
         ):
             return False
-        return True
+        return False
 
     @method_decorator(login_required)
     def exam_toggle_archived(self, request, pk):
@@ -830,7 +843,8 @@ class ExamViews(View, LoginRequiredMixin):
         exam = get_object_or_404(self.Exam.objects.prefetch_related("author"), pk=pk)
 
         if request.user not in exam.author.all():
-            if not self.check_user_access(request.user, pk):
+            # We also let markers view the exam
+            if not self.check_user_access(request.user, pk, marker=True):
                 raise PermissionDenied
 
         can_edit = (
@@ -866,15 +880,22 @@ class ExamViews(View, LoginRequiredMixin):
             )
         elif self.app_name == "longs":
             questions = (
-                exam.exam_questions.select_related()
-                .prefetch_related(
-                    Prefetch(
-                        "series",
-                        queryset=LongSeries.objects.select_related(
-                            "modality", "examination", "plane", "contrast"
-                        ).prefetch_related(Prefetch("images")),
-                    ),
-                    "author"
+                exam.exam_questions.prefetch_related(
+                    #Prefetch(
+                    #    "series",
+                    #    queryset=LongSeries.objects.select_related(
+                    #        "modality", "examination", "plane", "contrast"
+                    #    ).prefetch_related(Prefetch("images")),
+                    #),
+                    "author",
+                    #"examquestiondetail",
+                    #"longsseries",
+                    "series",
+                    #"seriesdetail",
+                    "series__images",
+                    "series__plane",
+                    "series__examination"
+
                     # to_attr="prefetched_primary_answer"
                     # queryset=self.Answer.objects.filter(),
                     # "series",
@@ -1311,7 +1332,7 @@ class ExamViews(View, LoginRequiredMixin):
             raise Http404("Packet not in exam mode")
 
         if request.user not in exam.author.all():
-            if not self.check_user_access(request.user, pk):
+            if not self.check_user_marker_access(request.user, pk):
                 raise PermissionDenied
 
         if self.app_name == "anatomy":
@@ -1443,7 +1464,7 @@ class ExamViews(View, LoginRequiredMixin):
         exam: ExamBase = get_object_or_404(self.Exam, pk=pk)
 
         if request.user not in exam.author.all():
-            if not self.check_user_access(request.user, pk):
+            if not self.check_user_access(request.user, pk, marker=True):
                 raise PermissionDenied
 
         question = exam.get_questions()[sk]
@@ -2329,6 +2350,9 @@ class ExamViews(View, LoginRequiredMixin):
     def exam_stats(self, request, exam_id):
         exam: ExamBase = get_object_or_404(self.Exam, pk=exam_id)
 
+        if not self.check_user_edit_access(request.user, exam_id):
+            raise PermissionDenied()
+
         if not exam.exam_mode:
             raise Http404("Packet not in exam mode")