feat: restrict user answer compaction to admin users and update related tests

generic/views.py

@@ -3784,7 +3784,7 @@ class ExamViews(View, LoginRequiredMixin):
 
         # Load questions; prefetch 'answers' for apps that use them to avoid repeated DB hits
         questions_qs = exam.get_questions()
-        if self.app_name not in ("physics", "sbas"):
+        if self.app_name == "anatomy":
             questions_qs = questions_qs.prefetch_related("answers")
 
         # Materialize questions list for iteration
@@ -5302,13 +5302,11 @@ def view_answer_history(request, app_name, model_name, pk):
         raise PermissionDenied("You do not have permission to view this answer's history")
         
     if request.method == "POST":
-        action = request.POST.get("action")
-        if action == "compact_single":
-            compacted = compact_history_for_object(answer)
-            messages.success(request, f"Compacted single answer history. Removed {compacted} old revisions.")
-            return HttpResponseRedirect(request.path)
+        if not (request.user.is_superuser or request.user.is_staff):
+            raise PermissionDenied("Only admin users can compact history")
             
-        elif action == "compact_bulk":
+        action = request.POST.get("action")
+        if action == "compact_bulk":
             compacted_total = 0
             if exam:
                 answers_qs = Model.objects.filter(exam=exam)
@@ -5325,6 +5323,8 @@ def view_answer_history(request, app_name, model_name, pk):
                     compacted_total += compact_history_for_object(ans)
                 messages.success(request, f"Bulk compacted history for all answers in Case Collection '{collection}'. Removed {compacted_total} old revisions.")
             return HttpResponseRedirect(request.path)
+        else:
+            raise PermissionDenied("Invalid compaction action or action not allowed on an individual answer basis.")
             
     # GET request
     versions = Version.objects.get_for_object(answer).select_related("revision__user").order_by("-revision__date_created")