feat: restrict user answer compaction to admin users and update related tests

generic/tests/test_exam_submit_security.py

@@ -280,11 +280,26 @@ def test_answer_history_and_compacting(cid_manager_client, exam_data, logged_in_
     assert b"Version 2" in response.content
     assert b"Initial answer" in response.content
     
-    # Test Compact Single action
-    response_compact = cid_manager_client.post(url, {"action": "compact_single"})
+    # Test that compact_single is forbidden
+    response_compact_single = cid_manager_client.post(url, {"action": "compact_single"})
+    assert response_compact_single.status_code == 403 # forbidden/denied
+    
+    # Test Compact Bulk action is forbidden for non-admin/non-staff
+    response_compact_bulk_fail = cid_manager_client.post(url, {"action": "compact_bulk"})
+    assert response_compact_bulk_fail.status_code == 403
+    
+    # Elevate the user to superuser/admin to test successful bulk compaction
+    from django.contrib.auth import get_user_model
+    User = get_user_model()
+    manager_user = User.objects.get(username="manager1")
+    manager_user.is_superuser = True
+    manager_user.save()
+    
+    # Test Compact Bulk action (exam-wide compaction) succeeds for admin
+    response_compact = cid_manager_client.post(url, {"action": "compact_bulk"})
     assert response_compact.status_code == 302 # redirect
     
-    # Verify only 1 version remains
+    # Verify only 1 version remains for our answer object
     from reversion.models import Version
     versions = Version.objects.get_for_object(ans)
     assert versions.count() == 1